Add error messages for failed origin checks. Bug 292724, r=smaug+doronr, a=mkaply, NPOTB

extensions/xforms/nsXFormsControlStub.cpp

@@ -140,16 +140,18 @@ nsXFormsControlStub::ResetBoundNode()
                        nsIDOMXPathResult::FIRST_ORDERED_NODE_TYPE,
                        getter_AddRefs(result),
                        getter_AddRefs(modelNode));
-  NS_ENSURE_SUCCESS(rv, rv);
+
-  
+  if (NS_SUCCEEDED(rv)) {    
-  if (!result) {
+    if (result) {
-    return NS_OK;
+      // Get context node, if any  
+      result->GetSingleNodeValue(getter_AddRefs(mBoundNode));
+    }
+    rv = NS_OK;
+  } else {
+    nsXFormsUtils::ReportError(NS_LITERAL_STRING("controlBindError"), mElement);
   }
 
-  // Get context node, if any  
+  return rv;
-  result->GetSingleNodeValue(getter_AddRefs(mBoundNode));
-
-  return NS_OK;
 }
 
 /**

extensions/xforms/nsXFormsInstanceElement.cpp

@@ -183,8 +183,13 @@ nsXFormsInstanceElement::OnChannelRedirect(nsIChannel *OldChannel,
   mElement->GetOwnerDocument(getter_AddRefs(domDoc));
   nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
   NS_ENSURE_STATE(doc);
-  return nsXFormsUtils::CheckSameOrigin(doc->GetDocumentURI(), newURI) ?
+
-    NS_OK : NS_ERROR_ABORT;
+  if (!nsXFormsUtils::CheckSameOrigin(doc->GetDocumentURI(), newURI)) {
+    nsXFormsUtils::ReportError(NS_LITERAL_STRING("instanceLoadOrigin"), domDoc);
+    return NS_ERROR_ABORT;
+  }
+
+  return NS_OK;
 }
 
 // nsIStreamListener
@@ -401,6 +406,9 @@ nsXFormsInstanceElement::LoadExternalInstance(const nsAString &aSrc)
               rv = docChannel->AsyncOpen(this, nsnull);
             }
           }
+        } else {
+          nsXFormsUtils::ReportError(NS_LITERAL_STRING("instanceLoadOrigin"),
+                                     domDoc);
         }
       }
     }

extensions/xforms/nsXFormsSubmissionElement.cpp

@@ -364,8 +364,11 @@ nsXFormsSubmissionElement::OnChannelRedirect(nsIChannel *aOldChannel,
   nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
   NS_ENSURE_STATE(doc);
 
-  if (!CheckSameOrigin(doc->GetDocumentURI(), newURI))
+  if (!CheckSameOrigin(doc->GetDocumentURI(), newURI)) {
+    nsXFormsUtils::ReportError(NS_LITERAL_STRING("submitSendOrigin"),
+                               mElement);
     return NS_ERROR_ABORT;
+  }
 
   return NS_OK;
 }
@@ -1526,8 +1529,11 @@ nsXFormsSubmissionElement::SendData(const nsCString &uriSpec,
 
   nsresult rv;
 
-  if (!CheckSameOrigin(doc->GetDocumentURI(), uri))
+  if (!CheckSameOrigin(doc->GetDocumentURI(), uri)) {
+    nsXFormsUtils::ReportError(NS_LITERAL_STRING("submitSendOrigin"),
+                               mElement);
     return NS_ERROR_ABORT;
+  }
 
   // wrap the entire upload stream in a buffered input stream, so that
   // it can be read in large chunks.

extensions/xforms/resources/locale/en-US/xforms.properties

@@ -11,3 +11,6 @@ exprParseError       = XForms Error (10): Error parsing XPath expression: %S
 exprEvaluateError    = XForms Error (11): Error evaluating XPath expression: %S
 noModelError         = XForms Error (12): Could not find model for element
 instanceParseError   = XForms Error (13): Could not parse new instance data
+submitSendOrigin     = XForms Error (14): Security check failed! Trying to submit data to a different domain than document
+instanceLoadOrigin   = XForms Error (15): Security check failed! Trying to load instance data from a different domain than document
+controlBindError     = XForms Error (16): Could not bind control to instance data