1b5e7659c9
82495 - Support for the view-source protocol in CheckLoadURI
...
87887 - don't call InitPolicies or InitPrincipals if there are no prefs to process
83902 - Use weak reference to pref branch to avoid reference cycle
91619 - was leaking a char* - use nsXPIDLCString instead
86932 - Add support for per-site JS disabling to CanExecuteScripts
all bugs r=jesse, sr=dougt
2001-08-02 20:32:48 +00:00
dbd7fed5b1
FASTLOAD_20010703_BRANCH landing, r=dbaron, sr=shaver.
2001-07-31 19:05:34 +00:00
f3d9b0caa1
Bug 77485 - defining a function in another window using a targeted javascript:
...
link. Prevent running javascript: urls cross-domain and add a security check for adding
and removing properties. r=harishd, sr=jst.
2001-07-13 07:08:26 +00:00
8c0cd58b30
Re-checking-in my fix for 47905, which was backed out last night because of a bug in some other code that was checked in along with it. This checkin was not causing the crasher and is unchanged. See earlier checkin comment - in short, this adds same-origin to XMLHttpRequest and cleans up some function calls in caps, removes some unnecessary parameters. r=vidur, sr=jst.
2001-05-19 00:33:51 +00:00
678b80f10b
Back out mstoltz because of blocker bug #81629 . Original bugs were 47905 79775.
2001-05-18 17:41:23 +00:00
11f7b8f900
Bug 47905 - adding security check for XMLHttpRequest.open.
...
Added nsIScriptSecurityManager::CheckConnect for this purpose.
Also cleaned up the security check API by removing some unnecessary
parameters. r=vidur@netscape.com , sr=jst@netscape.com
Bug 79775 - Forward button broken in main mail window. Making
WindowWatcher not call GetSubjectPrincipal if the URL to be loaded is
chrome, since the calling principal is superfluous in this case.
No one has been able to find the root cause of this problem, but
this checkin works around it, which is the best we can do for now.
r=ducarroz@netscape.com , sr=jst@netscape.com
2001-05-18 06:56:29 +00:00
59c995612e
Fixes for bugs 79796, 77203, and 54060. r=jband@netscape.com,
...
sr=brendan@mozilla.org
2001-05-11 00:43:27 +00:00
f7460d0269
Landing the XPCDOM_20010329_BRANCH branch, changes mostly done by jband@netscape.com and jst@netscape.com, also some changes done by shaver@mozilla.org, peterv@netscape.com and markh@activestate.com. r= and sr= by vidur@netscape.com, jband@netscape.com, jst@netscpae.com, danm@netscape.com, hyatt@netscape.com, shaver@mozilla.org, dbradley@netscape.com, rpotts@netscape.com.
2001-05-08 16:46:42 +00:00
2b6e6516d2
More fixes for 55237, cleaned up CheckLoadURI and added a check on "Edit This Link." Also added error reporting (bug 40538).
...
r=beard, sr=hyatt
2001-04-17 01:21:44 +00:00
519500116e
Bugs 55069, 70951 - JS-blocking APIs for mailnews and embedding. r=mscott, sr=attinasi.
...
Bug 54237 - fix for event-capture bug, r=heikki, sr=jband.
2001-03-23 04:22:56 +00:00
33c8110175
bug 47905, adding security check to XMLHttpRequest.open(). r=heikki, sr=brendan
2001-03-02 00:09:20 +00:00
41054417f6
Bug 66369, adding support for per-file permissions granting to caps. r=jst, sr=jband.
2001-01-27 01:42:20 +00:00
b3d21fb8f4
fix bug 55506. If seman was initialized too early then it was failing to register its nameset. This happened on first run when JS Component Loader would use the secman. The result was that all calls to the security manager via JavaScript would fail for that session. This fixes that by continuing to try to register the nameset until it actually succeeds. r=mstoltz a=brendan
2000-11-30 05:32:08 +00:00
c063d33489
bug 44147, caps grant dialog now being created from DOMWindow->GetPrompter instead of nsIPrompt service. r=dbragg
2000-09-09 00:53:21 +00:00
e5e279fe36
bug#49786 Caching frequently used progid: nsThreadJSContextStack r=waterson
2000-08-22 06:02:14 +00:00
ea5d41851a
Fixing 41876 r=hyatt, also 48724, 49768, and crasher in nsBasePrincipal.cpp, r=jtaylor
2000-08-22 02:06:52 +00:00
84b5fd67e3
Bug 46711. Removed nsAutoString travisty from nsStringKey. Introduced nsCStringKey. Made them both share the underlying string when possible. r=waterson
2000-08-10 06:19:37 +00:00
b65db40d35
Fixing 40159, nasty infinite recursion on startup. r&a=beard
2000-07-26 04:53:01 +00:00
3910fcba0b
fix for 42387, r=dveditz
2000-07-20 01:16:15 +00:00
d1da06c856
DOM properties default to same origin access only. Bug 28443. r=rginda
2000-07-05 19:08:20 +00:00
79c210a6b9
Checking in for mccabe, since he had to leave town. Partial fix for bug 41429. Adding a new interface that components can implement to control the capabilities needed for XPConnect access to them - default is UniversalXPConnect. r=vidur
2000-06-23 14:32:38 +00:00
ead929a4a4
Allow scripting of plugins by untrusted web scripts. Bug 36375.
2000-05-17 02:38:22 +00:00
11718e9f56
Removing archive attribute from nsCertificatePrincipal. This will not be used.
2000-05-16 22:37:38 +00:00
e0fc50a6d4
Fixes for 32878, 37739. Added PR_CALLBACK macros. Changed security.principal pref syntax to a nicer syntax. Removed "security.checkxpconnect" hack.
2000-05-16 03:40:51 +00:00
ad755522c3
Added archive attribute to nsICertificatePrincipal...part of fix for 37481.
2000-05-01 23:39:51 +00:00
9bb975256e
Fixes for 27010, 32878, and 32948.
2000-04-26 03:50:07 +00:00
57feeae5ec
Backing out changes until I can figure out why it's crashing on startup.
2000-04-23 21:25:39 +00:00
62bffdd26e
Fixes for bugs 27010, 32878, 32948.
2000-04-23 20:30:29 +00:00
e356de6476
Fix
...
28390, 28866, 34364
r=brendan@mozilla.org
35701
r=jst@netscape.com
2000-04-14 03:14:53 +00:00
16e912ab31
# 34082
...
r= warren@netscape.com
OS/2 Visual Age build - Adding PR_CALLBACK to some functoins for linkage
2000-04-05 02:32:07 +00:00
efa5624e14
Fixed bug 30915 using nsAggregatePrincipal. r=norris
2000-03-31 00:31:18 +00:00
ea9d7682c1
Fix 31998 nsScriptSecurityManager not thread safe breaks table regress
2000-03-21 23:12:16 +00:00
7d053b70b0
Adding nsAggregatePrincipal support. r=norris
2000-03-21 04:05:35 +00:00
2b4b436f5f
Fix 25062 Reload vulnerability
...
25206 Reload vulnerability #2
Implement grant dialogs and persistence for capabilities.
most r=mstoltz, some code from morse w/ r=norris
2000-02-10 04:56:56 +00:00
c04c4d51f9
Fix bug #25864 watch() vulnerability
...
r=vidur,rogerl
2000-02-02 00:22:58 +00:00
8507a58ec3
Files:
...
caps/include/nsScriptSecurityManager.h
caps/src/nsScriptSecurityManager.cpp
modules/libpref/src/init/all.js
Fix
24565 nsScriptSecurityManager::GetSecurityLevel() is a performance
24567 re-write DOM glue security checks to avoid NS_WITH_SERVICE()
r=waterson
Files:
dom/src/base/nsGlobalWindow.cpp
layout/base/src/nsDocument.cpp
layout/base/src/nsGenericElement.cpp
Fix assertion failure for 1-character property names.
Files:
dom/src/jsurl/nsJSProtocolHandler.cpp
webshell/src/nsDocLoader.cpp
Fix 18653 "javascript:" URLs cross windows problems (probably regressi
r=nisheeth
Files:
layout/events/src/nsEventListenerManager.cpp
Fix
23834 document.onkeypress allows sniffing keystrokes
24152 document.onclick shows links from other window
r=joki
2000-01-23 04:23:14 +00:00
d0cbc99c85
Fix build bustage.
2000-01-18 22:35:27 +00:00
5014545a00
Implemented the reading of capabilities data from prefs. Reads codebase and certificate principal data and populates ScriptSecurityManager's principals table. bug= 18122 r=norris, rginda
2000-01-18 21:54:01 +00:00
cb0c532e85
Fix base class specifiers, since be default if they aren't specified it is Private
...
# 23237
r= warren@netscape.com , ftang@netscape.com , jband@netscape.com
2000-01-11 01:45:34 +00:00
ddb2282b6c
Fix
...
858 [Feature] JavaScript auto-disable per-domain RFE
13023 Users must be able to disable Java and JavaScript (for JS in mail)
21923 Executing functions in "chrome:" protocol - #2 .
r=mstoltz
(Checked in with red on Mac; Wan-Teh says his changes are localized so
it shouldn't interfere with his fixing bustage.)
2000-01-08 16:51:54 +00:00
4f128298d2
Fix 22909 previousSibling vulnerability
...
r=mstoltz
2000-01-06 00:59:18 +00:00
7d4fa072a5
Fix for leak/bloat stats going negative. a=jar
1999-12-10 04:27:52 +00:00
51842ef45e
Fix 18553 [DOGFOOD] addEventListener allows sniffing keystrokes
...
Add checks to nsScriptSecurityManager::CheckCanListenTo that take
a principal and ensure that the currently executing script code
either is from the same origin as that principal or has the
UniversalBrowserRead privilege enabled. (chrome code has all
privileges enabled by default.) It's okay for the principal passed in
to be null. That just signifies a privileged window/document that only
can be listened to with privileges.
I added GetPrincipal/SetPrincipal methods to nsIEventListenerManager.
nsDocument::GetNewListenerManager sets a principal on the listener
manager when it creates one. Obviously there are other places that
create listener managers, but scripts seem to go through this one.
Another change is to save some memory usage. Currently I allocate an
array of PolicyType that is NS_DOM_PROP_MAX elements long.
Unfortunately, compilers appear to allocate four bytes for each
PolicyType, so the array takes around 2400 bytes. I've added changes
to use two bit vectors that should consume about 1/16 that space.
r=joki
There are also changes that push nsnull onto the JSContext stack when
entering a nested event loop.
r=jband
1999-11-25 05:28:18 +00:00
24778bda71
Modify generated dom code to use a enum rather than a string for codesize
...
and efficiency.
Tighten checks on document properties and node properties. Should resolve
several bugs:
18965 document.firstChild vulnerability
19043 document.childNodes vulnerability
19044 document.lastChild vulnerability
r=mstoltz
1999-11-20 07:28:34 +00:00
5b4b0169aa
* Fix 12124 [DOGFOOD] Reading user's preferences
...
* Implement site-specific security policies (bug 858)
r=mstoltz
* Use Recycle rather than delete[] to clean up Purify logs
r=law
1999-11-16 05:07:31 +00:00
7cd400a26f
* Fix the following bugs by tightening the default security policy.
...
17977 [DOGFOOD] Reading documents using document.body
17538 document.lastModified is exposed
17537 document.images vulnerabilities
16036 [DOGFOOD] document.Element exposes the DOM of documents from
15757 [DOGFOOD] Injecting JS code using setAttribute and getElemen
15550 Injecting text in documents from any domain using createText
15067 [DOGFOOD] getElementsByTagName() allows reading of arbitrary
* Create an array of dom property policy types and initialize it when the script security manager is created.
* Move some implementation code to a new shared implementation base class.
* Implement privilege enabling, disabling and reverting
* Implement stack walking for checking privileges.
r=mstoltz@netscape.com
* Modify nsIPref to support security policy work.
r=neeti@netscape.com
1999-11-11 22:10:36 +00:00
142ac52eaf
updated xPL license boilerplate to v1.1, a=chofmann@netscape.com,r=endico@mozilla.org
1999-11-06 03:43:54 +00:00
e5c170a049
work on bug 7270.
...
r=mstoltz.
Implement netscape.security.PrivilegeManager callbacks.
1999-10-28 22:09:03 +00:00
c99b609910
Add ability to disable JS. Fix 13978 shopping at webvan.com crashes
1999-09-17 20:13:52 +00:00
2b35be101c
Remove nsPrincipalManager.h
1999-09-15 21:30:10 +00:00
9acf604770
Add security support for javascript: uris.
1999-09-15 20:58:41 +00:00
0865f1cdaa
Create preferences for security checks.
...
Add new methods on nsIScriptSecurityManager for capabilities.
Fix 13739 MLK: nsScriptSecurityManager::CreateCodebasePrincipal
Fix 11666 Eliminate plvector (was: [infinite loop] bugs - plvector.c)
1999-09-15 04:05:43 +00:00
6ce2283719
Remove unused files.
1999-09-13 20:10:24 +00:00
2d8e12375f
* Add checks on urls formed from web scripts
...
* Make nsScriptSecurityManager implement nsXPCSecurityManager
* Fix unix warnings
1999-09-07 02:54:19 +00:00
51d59f6f69
Cleaned it up and eliminated the pointless #!gmake.
1999-09-01 23:27:16 +00:00
ec9d253f50
Add all-powerful system principals. Remove some dead code from the build.
1999-09-01 00:54:35 +00:00
9577b5cefa
Remove IGNORE_MANIFEST=1. It doesn't do anything and it confuses people.
1999-09-01 00:54:34 +00:00
d8507f844e
* clean up nsScriptSecurityManager
...
* remove nsJSSecurityManager
* save principals in nsIChannels and nsIDocuments
1999-08-29 21:58:42 +00:00
84982717ce
Spam caps subtree to replace declarations of IDL-defined interface methods in implementation classes with xpidl-generated NS_DECL_NSIFOO macro.
1999-08-21 20:22:27 +00:00
1b252b2e3b
includes updates to codbase matching security checks currently turned off
...
but in place. redefined the script security manager in caps and it is
now generating codebase principals.
1999-08-20 09:51:02 +00:00
4b06750b30
removed zip support from caps module. from now on all that stuff will
...
be used by libjar. should also remove a lot of memory leaks reported on
nsZip
1999-08-07 21:40:33 +00:00
9655521b0f
Fix to bug 11330 and some changes to reduce warnings in linux builds
1999-08-07 19:59:31 +00:00
a1d83223f4
added a new and improved factory to caps module. fixed some bugs and
...
cleared some warnings. also move some methods of privilege manager to
principal manager.
1999-08-06 22:44:35 +00:00
0fc6c99e2d
fix warnings
1999-08-05 19:47:10 +00:00
7047e55c1e
Added a newline to the EOF to fix the Unix native compiler builds.
1999-08-02 06:33:08 +00:00
0d16b83058
add a principal manager to caps api. everything is now xpidled so
...
i removed the public directory from the module.
1999-08-01 21:26:02 +00:00
387cbc374e
xpidling and updating nsTarget object. should resolve build errors on
...
SeaMonkey Ports
1999-07-28 05:43:26 +00:00
d00edf950d
removed some enums and migrated them into nsPrivilege, nsIPrivilege and
...
nsPrivilegemanager. cleaning up some old code from the security module
and refining their api's and such like.
1999-07-27 00:50:59 +00:00
5923fce74f
Some compilers also object to #endif's with any non-comment tokens after them. Fixed.
1999-07-26 21:08:51 +00:00
076494e4cb
Added a newline to the end of the file to fix the native-compiler Unix builds (HP-UX, Solaris, etc.).
1999-07-26 21:06:59 +00:00
3cc6d68ad6
i think i may have broken linux build with a tab at the end of a line in
...
the makefile, hope this was all for the bustage.
1999-07-24 04:18:22 +00:00
8dad60d09d
Fix to the caps security module. I removed the nsPrincipal struct, from now
...
on you can access principals by their xpcomed interface nsIPrincipal.
1999-07-24 03:58:23 +00:00
587d04c222
idled principals interfaces and some fixes to caps manager...
1999-07-16 20:31:18 +00:00
f64740e501
Move several security files into idl. (Create idl directory in caps module.)
...
Implement methods of nsIXPCSecurityManager.
Fix random errors in DOM JS security.
1999-07-15 23:23:16 +00:00
06317a54b3
Tom Pixley's code for the beginnings of DOM security, with a fix for the previous Mac link failure.
1999-07-07 07:50:03 +00:00
37a6739ec1
Backing out js security changes.
1999-07-01 13:03:35 +00:00
ccd5375141
New JavaScript/DOM security stuff.
1999-07-01 10:38:26 +00:00
ba1f9dee86
Checking in changes from Bob Glickstein
1998-12-15 05:53:19 +00:00
e2b921bf3c
Add cvsignore entries for makefiles generated bu autoconf.
1998-12-05 09:07:33 +00:00
bc992a7bb0
Remove extraneous Makefile files.
1998-12-05 08:19:05 +00:00
ce4f25a746
Deleted unnecessary nsCCapsManager:: from the prototype
1998-12-01 03:00:42 +00:00
5b7786e40c
XP_COM interfaces for JS calls into CAPS
1998-11-23 00:27:00 +00:00
231ff43d7a
Changes to make caps into a DLL. Defined all strings in this file until there is a replacement for allxpstr.h
1998-11-19 05:22:28 +00:00
eb1dd00c2c
Bug fixes from MozillaClassic branch, plus changes to build caps without rdf
1998-11-16 21:57:13 +00:00
23466e2008
Bug fixes to make caps stuff work with jvm's codesource principals
1998-10-28 03:31:17 +00:00
eb854d55b9
Fix to make it compile on HP-UX. Define an else clause in the if statement of an inline function. Thanks briano
1998-10-19 18:25:01 +00:00
ccee89d6a8
Added verification certifcates that are created via nsICapsManager. This could be used by JVM plugins.
1998-10-15 20:56:34 +00:00
191dfa4366
Backing out my previous check-in. I was told my changes built ok on Mac, But I wasn't given complete information. Sorry for trouble.
1998-10-14 05:01:12 +00:00
5f82c88ba4
Support for nsICertPrincipal. We do the certificate verification of certificates passed by JavaSoft
1998-10-14 02:52:40 +00:00
3e5359a28f
Adding -reg_mode flag related APIs
1998-10-06 21:00:36 +00:00
b87ef13ca0
Adding filecode base check routine
1998-10-06 20:59:47 +00:00
34d9668524
Reenabled the code that fixes the memory leaks during startup. I have compiled these changes on windows, solaris, linux. Lasttime I checked in, Mac compiled ok.
1998-09-30 18:06:19 +00:00
be4cd9ab8e
Backing my last checkin
1998-09-27 03:15:11 +00:00
ba17d5bef8
Fixed the memory leaks during startup
1998-09-27 01:22:41 +00:00
7563a7dd9d
Bring autoconf build up to date with non-autoconf build
1998-09-21 19:25:58 +00:00
e0444fcc03
Bring autoconf build up to date with non-autoconf build
1998-09-19 22:28:51 +00:00
10d9766023
Added CertChain Principal support for Javasoft. Added calls for AskPermission and SetPermission
1998-09-19 00:06:44 +00:00
3b0249a287
09171998 LiveConnect Carpool
1998-09-17 19:20:20 +00:00
9e48871a6a
Added nsCCodeSourcePrinicipal.h to export line
1998-09-17 18:49:51 +00:00
1e86d67968
New xpcom caps manager apis
1998-09-17 18:12:32 +00:00
9b5baab042
Added AskPermission and SetPermission API calls for OJI. Added the CertChain Principal support for JavaSoft.
1998-09-16 18:39:48 +00:00
5f24c79522
Added getSigners API for SmartUpate
1998-09-02 19:10:57 +00:00
9020b80c52
Updates to autoconf files.
1998-08-26 04:04:57 +00:00
84f1cedcbb
AUTOCONF_1_0 landing.
1998-08-19 20:42:14 +00:00
3ba8fa1b75
Add routine to initialize capabilities code.
...
Code was actually written by raman.
1998-08-06 19:41:12 +00:00
bb30d1cf9b
Adde context as argument to all caps public methods that could be used by JS
1998-08-04 23:54:29 +00:00
c9bd5d8074
Landing changes in the OJI_19980727_BRANCH since the OJI_19980727_TIP_MERGE tag.
1998-07-31 20:19:50 +00:00
13b18ece68
Committed from OJI_19980618_TIP_MERGE1.
1998-07-28 02:07:25 +00:00
b00270bebb
This is not part of any build system. caps is part of OJI effort. It will be used by JavaScript in future. Approved by warren/jar/jsw.
1998-07-10 21:12:19 +00:00
c2336343ab
This is not part of any build system. caps is part of OJI effort. It will be used by JavaScript in future
1998-07-10 03:19:59 +00:00
mstoltz%netscape.com
brendan%mozilla.org
blizzard%redhat.com
jst%netscape.com
jband%netscape.com
dp%netscape.com
warren%netscape.com
vidur%netscape.com
norris%netscape.com
mkaply%us.ibm.com
waterson%netscape.com
jdunn%netscape.com
dmose%mozilla.org
briano%netscape.com
cyeh%netscape.com
mccabe%netscape.com
arielb%netscape.com
sspitzer%netscape.com
joki%netscape.com
raman%netscape.com
ramiro%netscape.com
racham%netscape.com
sudu%netscape.com
blizzard%appliedtheory.com
beard%netscape.com
cls%seawood.org
raman