Bug 1131470 - Part 4: Check sandboxing flag for orientation lock. r=baku

--HG--
extra : rebase_source : a9e6916dae1484c47c88d3d07826aba0a048cf69

dom/base/ScreenOrientation.cpp

@@ -4,6 +4,7 @@
 
 #include "ScreenOrientation.h"
 #include "nsIDeviceSensors.h"
+#include "nsSandboxFlags.h"
 #include "nsScreen.h"
 
 using namespace mozilla::dom;
@@ -302,7 +303,7 @@ ScreenOrientation::LockInternal(ScreenOrientationInternal aOrientation, ErrorRes
   p->MaybeReject(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
   return p.forget();
 #else
-  LockPermission perm = GetLockOrientationPermission();
+  LockPermission perm = GetLockOrientationPermission(true);
   if (perm == LOCK_DENIED) {
     p->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
     return p.forget();
@@ -425,7 +426,7 @@ ScreenOrientation::GetAngle(ErrorResult& aRv) const
 }
 
 ScreenOrientation::LockPermission
-ScreenOrientation::GetLockOrientationPermission() const
+ScreenOrientation::GetLockOrientationPermission(bool aCheckSandbox) const
 {
   nsCOMPtr<nsPIDOMWindow> owner = GetOwner();
   if (!owner) {
@@ -443,6 +444,11 @@ ScreenOrientation::GetLockOrientationPermission() const
     return LOCK_DENIED;
   }
 
+  // Sandboxed without "allow-orientation-lock"
+  if (aCheckSandbox && doc->GetSandboxFlags() & SANDBOXED_ORIENTATION_LOCK) {
+    return LOCK_DENIED;
+  }
+
   // Apps can always lock the screen orientation.
   if (doc->NodePrincipal()->GetAppStatus() >=
         nsIPrincipal::APP_STATUS_INSTALLED) {

dom/base/ScreenOrientation.h

@@ -100,7 +100,7 @@ private:
 
   void DispatchChangeEvent();
 
-  LockPermission GetLockOrientationPermission() const;
+  LockPermission GetLockOrientationPermission(bool aCheckSandbox) const;
 
   // Gets the responsible document as defined in the spec.
   nsIDocument* GetResponsibleDocument() const;

dom/base/nsContentUtils.cpp

@@ -1336,6 +1336,7 @@ nsContentUtils::ParseSandboxAttributeToFlags(const nsAttrValue* sandboxAttr)
                | SANDBOXED_SCRIPTS
                | SANDBOXED_AUTOMATIC_FEATURES
                | SANDBOXED_POINTER_LOCK
+               | SANDBOXED_ORIENTATION_LOCK
                | SANDBOXED_DOMAIN;
 
 // Macro for updating the flag according to the keywords
@@ -1347,6 +1348,7 @@ nsContentUtils::ParseSandboxAttributeToFlags(const nsAttrValue* sandboxAttr)
   IF_KEYWORD(allowscripts, SANDBOXED_SCRIPTS | SANDBOXED_AUTOMATIC_FEATURES)
   IF_KEYWORD(allowtopnavigation, SANDBOXED_TOPLEVEL_NAVIGATION)
   IF_KEYWORD(allowpointerlock, SANDBOXED_POINTER_LOCK)
+  IF_KEYWORD(alloworientationlock, SANDBOXED_ORIENTATION_LOCK)
   IF_KEYWORD(allowpopups, SANDBOXED_AUXILIARY_NAVIGATION)
 
   return out;

dom/base/nsGkAtomList.h

@@ -79,6 +79,7 @@ GK_ATOM(allowevents, "allowevents")
 GK_ATOM(allownegativeassertions, "allownegativeassertions")
 GK_ATOM(allowforms,"allow-forms")
 GK_ATOM(allowfullscreen, "allowfullscreen")
+GK_ATOM(alloworientationlock,"allow-orientation-lock")
 GK_ATOM(allowpointerlock,"allow-pointer-lock")
 GK_ATOM(allowpopups,"allow-popups")
 GK_ATOM(allowsameorigin,"allow-same-origin")

dom/base/nsSandboxFlags.h

@@ -76,4 +76,9 @@ const unsigned long SANDBOXED_DOMAIN = 0x100;
  * showModalDialog() method.
  */
 const unsigned long SANDBOXED_AUXILIARY_NAVIGATION = 0x200;
+
+/**
+ * This flag prevents locking screen orientation.
+ */
+const unsigned long SANDBOXED_ORIENTATION_LOCK = 0x400;
 #endif

dom/base/nsScreen.cpp

@@ -241,7 +241,7 @@ nsScreen::MozLockOrientation(const Sequence<nsString>& aOrientations,
     }
   }
 
-  switch (mScreenOrientation->GetLockOrientationPermission()) {
+  switch (mScreenOrientation->GetLockOrientationPermission(false)) {
     case ScreenOrientation::LOCK_DENIED:
       return false;
     case ScreenOrientation::LOCK_ALLOWED: