Issue 3108 - Implement security checks for elemhide registration channel on our end instead of leav…

lib/elemHideHitRegistration.js

Index: lib/elemHideHitRegistration.js
===================================================================
--- a/lib/elemHideHitRegistration.js
+++ b/lib/elemHideHitRegistration.js
@@ -60,40 +60,41 @@ let AboutHandler = exports.AboutHandler 
   },
 
   //
   // About module implementation
   //
 
   getURIFlags: function(uri)
   {
-    return ("HIDE_FROM_ABOUTABOUT" in Ci.nsIAboutModule ? Ci.nsIAboutModule.HIDE_FROM_ABOUTABOUT : 0);
+    return Ci.nsIAboutModule.HIDE_FROM_ABOUTABOUT;
   },
 
-  newChannel: function(uri)
+  newChannel: function(uri, loadInfo)

[Thomas Greiner, 2015/10/15 16:04:44]

Where is `loadInfo` coming from? It's not specified in the `nsIAboutModule`
interface.

[Wladimir Palant, 2015/10/15 17:59:16]

It is:
http://mxr.mozilla.org/mozilla-central/source/netwerk/protocol/about/nsIAbout...
(not on MDN of course because nobody thought of setting dev-doc-needed on
https://bugzilla.mozilla.org/show_bug.cgi?id=1067468). This is all part of a
huge refactoring effort under
https://bugzilla.mozilla.org/show_bug.cgi?id=1006868.

It's being passed in by the networking code. Older Firefox versions don't have
that parameter, but these also don't expect us to set nsIChannel.loadInfo - so
passing undefined around is ok here.

[Thomas Greiner, 2015/10/15 18:03:09]

I see, thanks for the details. I shouldn't have relied on MDN in that case.

   {
     let match = /\?(\d+)/.exec(uri.path);
     if (!match)
       throw Cr.NS_ERROR_FAILURE;
 
-    return new HitRegistrationChannel(uri, match[1]);
+    return new HitRegistrationChannel(uri, loadInfo, match[1]);
   },
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIFactory, Ci.nsIAboutModule])
 };
 AboutHandler.init();
 
 /**
  * Channel returning data for element hiding hits.
  * @constructor
  */
-function HitRegistrationChannel(uri, key)
+function HitRegistrationChannel(uri, loadInfo, key)
 {
   this.key = key;
   this.URI = this.originalURI = uri;
+  this.loadInfo = loadInfo;
 }
 HitRegistrationChannel.prototype = {
   key: null,
   URI: null,
   originalURI: null,
   contentCharset: "utf-8",
   contentLength: 0,
   contentType: "text/xml",
@@ -117,16 +118,23 @@ HitRegistrationChannel.prototype = {
         listener.onDataAvailable(this, context, stream, 0, stream.available());
       } catch(e) {}
       try {
         listener.onStopRequest(this, context, Cr.NS_OK);
       } catch(e) {}
     });
   },
 
+  asyncOpen2: function(listener)
+  {
+    if (!this.loadInfo.triggeringPrincipal.equals(Utils.systemPrincipal))
+      throw Cr.NS_ERROR_FAILURE;
+    this.asyncOpen(listener, null);
+  },
+
   open: function()
   {
     let {Policy} = require("contentPolicy");
     let {ElemHide} = require("elemHide");
 
     // This dummy binding below won't have any effect on the element. For
     // elements that should be hidden however we don't return any binding at
     // all, this makes Gecko stop constructing the node - it cannot be shown.