Bug 342484 - replace livemark service's call to CheckLoadURIStr with …

…a call to CheckLoadURIWithPrincipal, r=sayrer, sr=bz, a=mconnor
iaxat · Dec 14, 2007 · 00cd61e · 00cd61e
1 parent 169e000
commit 00cd61e
Show file tree

Hide file tree

Showing 4 changed files with 175 additions and 3 deletions.
diff --git a/toolkit/components/places/src/nsLivemarkService.js b/toolkit/components/places/src/nsLivemarkService.js
@@ -500,7 +500,8 @@ LivemarkLoadListener.prototype = {
 
     // We need this to make sure the item links are safe
     var secMan = Cc[SEC_CONTRACTID].getService(Ci.nsIScriptSecurityManager);
-
+    var feedPrincipal = secMan.getCodebasePrincipal(this._livemark.feedURI);
+
     // Clear out any child nodes of the livemark folder, since
     // they're about to be replaced.
     var lmService = Cc[LS_CONTRACTID].getService(Ci.nsILivemarkService);
@@ -534,8 +535,7 @@ LivemarkLoadListener.prototype = {
         continue;
 
       try {
-        secMan.checkLoadURIStr(this._livemark.feedURI.spec, href.spec,
-                               SEC_FLAGS);
+        secMan.checkLoadURIWithPrincipal(feedPrincipal, href, SEC_FLAGS);
       }
       catch(ex) {
         continue;

diff --git a/toolkit/components/places/tests/chrome/Makefile.in b/toolkit/components/places/tests/chrome/Makefile.in
@@ -46,10 +46,12 @@ include $(topsrcdir)/config/rules.mk
 
 _HTTP_FILES	= \
 		sample_feed.atom \
+		bad_links.atom \
 		$(NULL)
 
 _CHROME_FILES	= \
 		test_371798.xul \
+		test_342484.xul \
 		$(NULL)
 
 libs:: $(_HTTP_FILES)

diff --git a/toolkit/components/places/tests/chrome/bad_links.atom b/toolkit/components/places/tests/chrome/bad_links.atom
@@ -0,0 +1,74 @@
+<?xml version="1.0" encoding="utf-8"?>
+<feed xmlns="http://www.w3.org/2005/Atom">
+
+  <title>Example Feed</title> 
+  <link href="http://example.org/"/>
+  <updated>2003-12-13T18:30:02Z</updated>
+
+  <author> 
+    <name>John Doe</name>
+  </author> 
+  <id>urn:uuid:60a76c80-d399-11d9-b93C-0003939e0af6</id>
+
+  <entry>
+
+    <title>First good item</title>
+    <link href="http://example.org/first"/>
+    <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6a</id>
+    <updated>2003-12-13T18:30:02Z</updated>
+
+    <summary>Some text.</summary>
+  </entry>
+
+  <entry>
+
+    <title>data: link</title>
+    <link href="data:text/plain,Hi"/>
+    <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6b</id>
+    <updated>2003-12-13T18:30:03Z</updated>
+
+    <summary>Some text.</summary>
+  </entry>
+
+  <entry>
+
+    <title>javascript: link</title>
+    <link href="javascript:alert('Hi')"/>
+    <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6c</id>
+    <updated>2003-12-13T18:30:04Z</updated>
+
+    <summary>Some text.</summary>
+  </entry>
+
+  <entry>
+
+    <title>file: link</title>
+    <link href="file:///var/"/>
+    <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6d</id>
+    <updated>2003-12-13T18:30:05Z</updated>
+
+    <summary>Some text.</summary>
+  </entry>
+
+  <entry>
+
+    <title>chrome: link</title>
+    <link href="chrome://browser/content/browser.js"/>
+    <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6e</id>
+    <updated>2003-12-13T18:30:06Z</updated>
+
+    <summary>Some text.</summary>
+  </entry>
+
+  <entry>
+
+    <title>Last good item</title>
+    <link href="http://example.org/last"/>
+    <id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6b</id>
+    <updated>2003-12-13T18:30:07Z</updated>
+
+    <summary>Some text.</summary>
+  </entry>
+
+
+</feed>
diff --git a/toolkit/components/places/tests/chrome/test_342484.xul b/toolkit/components/places/tests/chrome/test_342484.xul
@@ -0,0 +1,96 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<?xml-stylesheet
+  href="chrome://mochikit/content/tests/SimpleTest/test.css" type="text/css"?>
+<window title="Add Bad Livemarks"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script type="application/javascript"
+   src="chrome://mochikit/content/MochiKit/packed.js"></script>
+  <script type="application/javascript"
+   src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+
+  <body xmlns="http://www.w3.org/1999/xhtml" />
+
+<script type="application/javascript">
+<![CDATA[
+/*
+ Test loading feeds with items that aren't allowed
+ */
+SimpleTest.waitForExplicitFinish();
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cr = Components.results;
+
+var iosvc = Cc["@mozilla.org/network/io-service;1"].getService(Ci.nsIIOService);
+
+function uri(spec) {
+  return iosvc.newURI(spec, null, null);
+}
+
+var lmsvc = Cc["@mozilla.org/browser/livemark-service;2"].
+              getService(Ci.nsILivemarkService);
+var bmsvc = Cc["@mozilla.org/browser/nav-bookmarks-service;1"].
+              getService(Ci.nsINavBookmarksService);
+var histsvc = Cc["@mozilla.org/browser/nav-history-service;1"].
+                getService(Ci.nsINavHistoryService);
+
+var toolbarFolderId = bmsvc.toolbarFolder;
+
+var observer =
+{
+  QueryInterface: function(iid) {
+    if (iid.equals(Ci.nsINavBookmarkObserver) ||
+        iid.equals(Ci.nsISupports))
+      return this;
+    throw Cr.NS_ERROR_NO_INTERFACE;
+  },
+
+  // nsINavBookmarkObserve
+  onBeginUpdateBatch: function(){},
+  onEndUpdateBatch: function(){
+    setTimeout(runTest, 1000);
+    bmsvc.removeObserver(this);
+  },
+  onItemAdded: function(itemId, folder, index) {},
+  onItemRemoved: function(itemId, folder, index){},
+  onItemChanged: function(itemId, property, isAnnotationProperty, value){},
+  onItemVisited: function(itemId, aVisitID, time){},
+  onItemMoved: function(itemId, oldParent, oldIndex, newParent, newIndex){},
+
+};
+
+function runTest() {
+  var goodItems = ["http://example.org/first", "http://example.org/last"];
+  var options = histsvc.getNewQueryOptions();
+  var query = histsvc.getNewQuery();
+  query.setFolders([gLivemarkId], 1);
+  var result = histsvc.executeQuery(query, options);
+  var rootNode = result.root;
+  rootNode.containerOpen = true;
+
+  var cc = rootNode.childCount;
+  ok(cc == 2, "failed to create the two good livemark items");
+  for (var i = 0; i < cc; ++i) {
+    var node = rootNode.getChild(i);
+    ok(goodItems.indexOf(node.uri) != -1, "livemark item created with bad uri " + node.uri);
+  }
+
+  rootNode.containerOpen = false;
+  bmsvc.removeFolder(gLivemarkId);
+  SimpleTest.finish();
+}
+
+var root = bmsvc.bookmarksRoot;
+const FEEDSPEC = "http://localhost:8888/tests/toolkit/components/places/tests/chrome/bad_links.atom";
+
+gLivemarkId = lmsvc.createLivemarkFolderOnly(bmsvc, toolbarFolderId, "foo",
+                                            uri("http:/localhost/"),
+                                            uri(FEEDSPEC), -1);
+bmsvc.addObserver(observer, false);
+lmsvc.reloadLivemarkFolder(gLivemarkId);
+]]>
+</script>
+
+</window>