Bug 292464 - event listeners added using addEventListener() listen only trusted events. r=jst, sr=peterv, a=chofmann

content/base/src/nsDocument.cpp

@@ -3975,7 +3975,14 @@ nsDocument::AddEventListener(const nsAString& aType,
                              nsIDOMEventListener* aListener,
                              PRBool aUseCapture)
 {
-  return AddGroupedEventListener(aType, aListener, aUseCapture, nsnull);
+  PRBool permitUntrustedEvents = PR_FALSE;
+  if (mDocumentURI) {
+    PRBool isChrome = PR_TRUE;
+    nsresult rv = mDocumentURI->SchemeIs("chrome", &isChrome);
+    NS_ENSURE_SUCCESS(rv, rv);
+    permitUntrustedEvents = !isChrome;
+  }
+  return AddEventListener(aType, aListener, aUseCapture, permitUntrustedEvents);
 }
 
 nsresult

content/base/src/nsGenericElement.cpp

@@ -627,15 +627,21 @@ nsDOMEventRTTearoff::GetSystemEventGroup(nsIDOMEventGroup **aGroup)
 
 // nsIDOMEventTarget
 NS_IMETHODIMP
-nsDOMEventRTTearoff::AddEventListener(const nsAString& type,
-                                      nsIDOMEventListener *listener,
+nsDOMEventRTTearoff::AddEventListener(const nsAString& aType,
+                                      nsIDOMEventListener *aListener,
                                       PRBool useCapture)
 {
-  nsCOMPtr<nsIDOMEventReceiver> event_receiver;
-  nsresult rv = GetEventReceiver(getter_AddRefs(event_receiver));
-  NS_ENSURE_SUCCESS(rv, rv);
+  PRBool permitUntrustedEvents = PR_FALSE;
+  nsIDocument *ownerDoc = mContent->GetOwnerDoc();
+  nsIURI *docUri;
+  if (ownerDoc && (docUri = ownerDoc->GetDocumentURI())) {
+    PRBool isChrome = PR_TRUE;
+    nsresult rv = docUri->SchemeIs("chrome", &isChrome);
+    NS_ENSURE_SUCCESS(rv, rv);
+    permitUntrustedEvents = !isChrome;
+  }
 
-  return event_receiver->AddEventListener(type, listener, useCapture);
+  return AddEventListener(aType, aListener, useCapture, permitUntrustedEvents);
 }
 
 NS_IMETHODIMP

content/events/src/nsEventListenerManager.cpp

@@ -758,7 +758,8 @@ nsEventListenerManager::RemoveEventListener(nsIDOMEventListener *aListener,
 
   for (PRInt32 i=0; i<listeners->Count(); i++) {
     ls = (nsListenerStruct*)listeners->ElementAt(i);
-    if (ls->mListener == aListener && ls->mFlags == aFlags) {
+    if (ls->mListener == aListener &&
+        (ls->mFlags & ~NS_PRIV_EVENT_UNTRUSTED_PERMITTED) == aFlags) {
       ls->mSubType &= ~aSubType;
       if (ls->mSubType == NS_EVENT_BITS_NONE) {
         NS_RELEASE(ls->mListener);

content/events/src/nsEventListenerManager.h

@@ -51,11 +51,11 @@ class nsIAtom;
 
 typedef struct {
   nsIDOMEventListener* mListener;
-  PRUint8 mFlags;
-  PRUint8 mSubType;
-  PRUint8 mHandlerIsString;
-  PRUint8 mSubTypeCapture;
+  PRUint16 mFlags;
   PRUint16 mGroupFlags;
+  PRUint8  mSubType;
+  PRUint8  mHandlerIsString;
+  PRUint8  mSubTypeCapture;
 } nsListenerStruct;
 
 //These define the internal type of the EventListenerManager

dom/src/base/nsGlobalWindow.cpp

@@ -4074,7 +4074,16 @@ nsGlobalWindow::AddEventListener(const nsAString& aType,
                                  nsIDOMEventListener* aListener,
                                  PRBool aUseCapture)
 {
-  return AddGroupedEventListener(aType, aListener, aUseCapture, nsnull);
+  PRBool permitUntrustedEvents = PR_FALSE;
+  nsCOMPtr<nsIDocument> doc(do_QueryInterface(mDocument));
+  nsIURI *docUri;
+  if (doc && (docUri = doc->GetDocumentURI())) {
+    PRBool isChrome = PR_TRUE;
+    nsresult rv = docUri->SchemeIs("chrome", &isChrome);
+    NS_ENSURE_SUCCESS(rv, rv);
+    permitUntrustedEvents = !isChrome;
+  }
+  return AddEventListener(aType, aListener, aUseCapture, permitUntrustedEvents);
 }
 
 NS_IMETHODIMP