From 68cc429fd300cce3a6f656cda32cd351e548fb17 Mon Sep 17 00:00:00 2001 From: "doronr%us.ibm.com" Date: Tue, 28 Jun 2005 16:30:50 +0000 Subject: [PATCH] XForms Bug 284519 - Need preference for whitelisting submission, instance loading, etc.. r=allan/smaug a=mkaply --- extensions/xforms/Makefile.in | 1 + extensions/xforms/jar.mn | 14 +- .../xforms/nsXFormsSubmissionElement.cpp | 67 +++- extensions/xforms/nsXFormsSubmissionElement.h | 1 + extensions/xforms/package/Makefile.in | 77 ---- .../{xforms.css => package/chrome.manifest} | 0 .../xforms/resources/content/contents.rdf | 49 +++ .../resources/content/xforms-prefs-ui.xul | 74 ++++ .../xforms/resources/content/xforms-prefs.js | 87 ++++ .../xforms/resources/content/xforms-prefs.xul | 54 +++ .../xforms/resources/content/xforms.css | 96 +++++ .../xforms/resources/content/xforms.xml | 371 ++++++++++++++++++ .../xforms/resources/locale/en-US/xforms.dtd | 39 ++ .../resources/locale/en-US/xforms.properties | 43 ++ extensions/xforms/xforms.xml | 0 15 files changed, 886 insertions(+), 87 deletions(-) rename extensions/xforms/{xforms.css => package/chrome.manifest} (100%) mode change 100755 => 100644 create mode 100755 extensions/xforms/resources/content/contents.rdf create mode 100644 extensions/xforms/resources/content/xforms-prefs-ui.xul create mode 100644 extensions/xforms/resources/content/xforms-prefs.js create mode 100644 extensions/xforms/resources/content/xforms-prefs.xul create mode 100755 extensions/xforms/resources/content/xforms.css create mode 100644 extensions/xforms/resources/content/xforms.xml create mode 100644 extensions/xforms/resources/locale/en-US/xforms.dtd delete mode 100644 extensions/xforms/xforms.xml diff --git a/extensions/xforms/Makefile.in b/extensions/xforms/Makefile.in index 20fc57fdb73..9dd17fd07e3 100644 --- a/extensions/xforms/Makefile.in +++ b/extensions/xforms/Makefile.in @@ -70,6 +70,7 @@ REQUIRES = \ transformiix \ schemavalidation \ intl \ + pref \ $(NULL) XPIDLSRCS = \ diff --git a/extensions/xforms/jar.mn b/extensions/xforms/jar.mn index 1fd9945ba1b..a7725880bf8 100755 --- a/extensions/xforms/jar.mn +++ b/extensions/xforms/jar.mn @@ -1,6 +1,14 @@ xforms.jar: - content/xforms/contents.rdf - content/xforms/xforms.xml -* content/xforms/xforms.css +% overlay chrome://browser/content/preferences/preferences.xul chrome://xforms/content/xforms-prefs.xul +% content xforms %content/xforms/ +% locale xforms en-US %locale/en-US/xforms/ + content/xforms/contents.rdf (resources/content/contents.rdf) +* content/xforms/xforms.css (resources/content/xforms.css) +* content/xforms/xforms-prefs.xul (resources/content/xforms-prefs.xul) +* content/xforms/xforms-prefs-ui.xul (resources/content/xforms-prefs-ui.xul) +* content/xforms/xforms-prefs.js (resources/content/xforms-prefs.js) + content/xforms/xforms.xml (resources/content/xforms.xml) * locale/en-US/xforms/contents.rdf (resources/locale/en-US/contents.rdf) locale/en-US/xforms/xforms.properties (resources/locale/en-US/xforms.properties) + locale/en-US/xforms/xforms.dtd (resources/locale/en-US/xforms.dtd) + diff --git a/extensions/xforms/nsXFormsSubmissionElement.cpp b/extensions/xforms/nsXFormsSubmissionElement.cpp index d9b35b71cf0..449ee89a2ca 100644 --- a/extensions/xforms/nsXFormsSubmissionElement.cpp +++ b/extensions/xforms/nsXFormsSubmissionElement.cpp @@ -89,6 +89,9 @@ #include "nsNetUtil.h" #include "nsXFormsUtils.h" #include "nsIDOMNamedNodeMap.h" +#include "nsIPermissionManager.h" +#include "nsIPrefBranch.h" +#include "nsIPrefService.h" // namespace literals #define NAMESPACE_XML_SCHEMA \ @@ -811,20 +814,70 @@ nsXFormsSubmissionElement::SerializeDataXML(nsIDOMNode *data, PRBool nsXFormsSubmissionElement::CheckSameOrigin(nsIURI *aBaseURI, nsIURI *aTestURI) { + PRBool result = PR_TRUE; + // We require same-origin for replace="instance" or XML submission if (mFormat & (ENCODING_XML | ENCODING_MULTIPART_RELATED) || mIsReplaceInstance) { - // if we don't replace the instance, we allow file:// to send the data - PRBool schemeIsFile = PR_FALSE; - + // if we don't replace the instance, we allow file:// or sites whitelisted + // to submit data if (!mIsReplaceInstance) { - aBaseURI->SchemeIs("file", &schemeIsFile); + aBaseURI->SchemeIs("file", &result); + + // lets check the permission manager + if (!result) { + result = CheckPermissionManager(aBaseURI); + } } - if (!schemeIsFile) - return nsXFormsUtils::CheckSameOrigin(aBaseURI, aTestURI); + if (!result) { + result = nsXFormsUtils::CheckSameOrigin(aBaseURI, aTestURI); + } } - return PR_TRUE; + + return result; +} + +PRBool +nsXFormsSubmissionElement::CheckPermissionManager(nsIURI *aBaseURI) +{ + PRBool result = PR_FALSE; + + nsresult rv; + nsCOMPtr prefBranch = + do_GetService(NS_PREFSERVICE_CONTRACTID, &rv); + + PRUint32 permission = nsIPermissionManager::UNKNOWN_ACTION; + + if (NS_SUCCEEDED(rv) && prefBranch) { + // check if the user has enabled the xforms cross domain preference + PRBool checkPermission = PR_FALSE; + prefBranch->GetBoolPref("xforms.crossdomain.enabled", &checkPermission); + + if (checkPermission) { + // if the user enabled the cross domain check, query the permission + // manager with the URI. It will return 1 if the URI was allowed by the + // user. + nsCOMPtr permissionManager = + do_GetService("@mozilla.org/permissionmanager;1"); + + nsCOMPtr domDoc; + mElement->GetOwnerDocument(getter_AddRefs(domDoc)); + + nsCOMPtr doc = do_QueryInterface(domDoc); + NS_ENSURE_STATE(doc); + + permissionManager->TestPermission(doc->GetDocumentURI(), + "xforms-xd", &permission); + } + } + + if (permission == nsIPermissionManager::ALLOW_ACTION) { + // not in the permission manager + result = PR_TRUE; + } + + return result; } nsresult diff --git a/extensions/xforms/nsXFormsSubmissionElement.h b/extensions/xforms/nsXFormsSubmissionElement.h index 670b8e09302..1ebb1156135 100644 --- a/extensions/xforms/nsXFormsSubmissionElement.h +++ b/extensions/xforms/nsXFormsSubmissionElement.h @@ -126,6 +126,7 @@ private: * there is no need for a same origin check. */ PRBool CheckSameOrigin(nsIURI *aBaseURI, nsIURI *aTestURI); + PRBool CheckPermissionManager(nsIURI *aBaseURI); nsresult AddNameSpaces(nsIDOMElement* aTarget, nsIDOMNode* aSource); }; diff --git a/extensions/xforms/package/Makefile.in b/extensions/xforms/package/Makefile.in index b7dca6178e6..e69de29bb2d 100755 --- a/extensions/xforms/package/Makefile.in +++ b/extensions/xforms/package/Makefile.in @@ -1,77 +0,0 @@ -# vim:set ts=8 sw=8 sts=8 noet: -# -# ***** BEGIN LICENSE BLOCK ***** -# Version: MPL 1.1/GPL 2.0/LGPL 2.1 -# -# The contents of this file are subject to the Mozilla Public License Version -# 1.1 (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# http://www.mozilla.org/MPL/ -# -# Software distributed under the License is distributed on an "AS IS" basis, -# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License -# for the specific language governing rights and limitations under the -# License. -# -# The Original Code is mozilla.org code. -# -# The Initial Developer of the Original Code is -# IBM Corporation. -# Portions created by the Initial Developer are Copyright (C) 2004 -# the Initial Developer. All Rights Reserved. -# -# Contributor(s): -# Brian Ryner -# -# Alternatively, the contents of this file may be used under the terms of -# either of the GNU General Public License Version 2 or later (the "GPL"), -# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"), -# in which case the provisions of the GPL or the LGPL are applicable instead -# of those above. If you wish to allow use of your version of this file only -# under the terms of either the GPL or the LGPL, and not to allow others to -# use your version of this file under the terms of the MPL, indicate your -# decision by deleting the provisions above and replace them with the notice -# and other provisions required by the GPL or the LGPL. If you do not delete -# the provisions above, a recipient may use your version of this file under -# the terms of any one of the MPL, the GPL or the LGPL. -# -# ***** END LICENSE BLOCK ***** - -DEPTH = ../../.. -topsrcdir = @top_srcdir@ -srcdir = @srcdir@ -VPATH = @srcdir@ - -include $(DEPTH)/config/autoconf.mk - -include $(topsrcdir)/config/rules.mk - -ifeq ($(OS_ARCH),WINNT) -PKGCP_PLATFORM = dos -PACKAGE_FILE = packages-win -else -PKGCP_PLATFORM=unix -ifeq ($(OS_ARCH),Darwin) -PACKAGE_FILE = packages-mac -else -PACKAGE_FILE = packages-unix -endif -endif - -GARBAGE += xforms.js xforms.template -GARBAGE_DIRS += stage - -PACKAGE_VERSION = 0.2 - -xpi: - @echo Copying files to staging area... - rm -rf stage - $(NSINSTALL) -D stage - $(PERL) $(topsrcdir)/xpinstall/packager/pkgcp.pl -o $(PKGCP_PLATFORM) -s $(DIST)/bin -d stage -f $(srcdir)/$(PACKAGE_FILE) -v - $(NSINSTALL) $(srcdir)/install.rdf stage/xforms - @echo Creating install.js... - rm -f xforms.js - $(PERL) $(topsrcdir)/toolkit/mozapps/installer/makejs.pl $(srcdir)/xforms.jst $(PACKAGE_VERSION) stage/xforms - if ! test -e "xforms.js"; then $(NSINSTALL) $(srcdir)/xforms.js .; fi - @echo Creating XPI... - $(PERL) $(topsrcdir)/toolkit/mozapps/installer/makexpi.pl xforms stage . diff --git a/extensions/xforms/xforms.css b/extensions/xforms/package/chrome.manifest old mode 100755 new mode 100644 similarity index 100% rename from extensions/xforms/xforms.css rename to extensions/xforms/package/chrome.manifest diff --git a/extensions/xforms/resources/content/contents.rdf b/extensions/xforms/resources/content/contents.rdf new file mode 100755 index 00000000000..1c9b2bd0404 --- /dev/null +++ b/extensions/xforms/resources/content/contents.rdf @@ -0,0 +1,49 @@ + + + + + + + + + + + + + diff --git a/extensions/xforms/resources/content/xforms-prefs-ui.xul b/extensions/xforms/resources/content/xforms-prefs-ui.xul new file mode 100644 index 00000000000..e5fe024f7e1 --- /dev/null +++ b/extensions/xforms/resources/content/xforms-prefs-ui.xul @@ -0,0 +1,74 @@ + + + + + + %xformsDTD; + %contentDTD; +]> + + + + + + + + + + + + + + + + + +