caps/idl/nsIPrincipal.idl

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
   2 /* This Source Code Form is subject to the terms of the Mozilla Public
   3  * License, v. 2.0. If a copy of the MPL was not distributed with this
   4  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   5
   6 /* Defines the abstract interface for a principal. */
   7
   8 #include "nsISerializable.idl"
   9
  10 %{C++
  11 struct JSPrincipals;
  12 #include "nsCOMPtr.h"
  13 #include "nsTArray.h"
  14 %}
  15
  16 interface nsIURI;
  17 interface nsIContentSecurityPolicy;
  18
  19 [ptr] native JSContext(JSContext);
  20 [ptr] native JSPrincipals(JSPrincipals);
  21 [ptr] native PrincipalArray(nsTArray<nsCOMPtr<nsIPrincipal> >);
  22
  23 [scriptable, builtinclass, uuid(551bf53d-203c-4ac4-8c0b-40aa7b5f1ad6)]
  24 interface nsIPrincipal : nsISerializable
  25 {
  26     /**
  27      * Returns whether the other principal is equivalent to this principal.
  28      * Principals are considered equal if they are the same principal, or
  29      * they have the same origin.
  30      */
  31     boolean equals(in nsIPrincipal other);
  32
  33     /**
  34      * Like equals, but doesn't take document.domain changes into account.
  35      */
  36     boolean equalsIgnoringDomain(in nsIPrincipal other);
  37
  38     %{C++
  39     inline bool Equals(nsIPrincipal* aOther) {
  40       bool equal = false;
  41       return NS_SUCCEEDED(Equals(aOther, &equal)) && equal;
  42     }
  43
  44     inline bool EqualsIgnoringDomain(nsIPrincipal* aOther) {
  45       bool equal = false;
  46       return NS_SUCCEEDED(EqualsIgnoringDomain(aOther, &equal)) && equal;
  47     }
  48     %}
  49
  50     /**
  51      * Returns a hash value for the principal.
  52      */
  53     [noscript] readonly attribute unsigned long hashValue;
  54
  55     /**
  56      * The domain security policy of the principal.
  57      */
  58     // XXXcaa should this be here?  The script security manager is the only
  59     // thing that should care about this.  Wouldn't storing this data in one
  60     // of the hashtables in nsScriptSecurityManager be better?
  61     // XXXbz why is this writable?  Who should have write access to this?  What
  62     // happens if this principal is in our hashtable and we pass it out of the
  63     // security manager and someone writes to this field?  Especially if they
  64     // write garbage?  If we need to give someone other than the security
  65     // manager a way to set this (which I question, since it can increase the
  66     // permissions of a page) it should be a |void clearSecurityPolicy()|
  67     // method.
  68     [noscript] attribute voidPtr securityPolicy;
  69
  70     /**
  71      * The codebase URI to which this principal pertains.  This is
  72      * generally the document URI.
  73      */
  74     readonly attribute nsIURI URI;
  75
  76     /**
  77      * The domain URI to which this principal pertains.
  78      * This is congruent with HTMLDocument.domain, and may be null.
  79      * Setting this has no effect on the URI.
  80      */
  81     [noscript] attribute nsIURI domain;
  82
  83     /**
  84      * The origin of this principal's codebase URI.
  85      * An origin is defined as: scheme + host + port.
  86      */
  87     // XXXcaa this should probably be turned into an nsIURI.
  88     // The system principal's origin should be some caps namespace
  89     // with a chrome URI.  All of chrome should probably be the same.
  90     readonly attribute string origin;
  91
  92     /**
  93      * Returns whether the other principal is equal to or weaker than this
  94      * principal. Principals are equal if they are the same object or they
  95      * have the same origin.
  96      *
  97      * Thus a principal always subsumes itself.
  98      *
  99      * The system principal subsumes itself and all other principals.
 100      *
 101      * A null principal (corresponding to an unknown, hence assumed minimally
 102      * privileged, security context) is not equal to any other principal
 103      * (including other null principals), and therefore does not subsume
 104      * anything but itself.
 105      */
 106     boolean subsumes(in nsIPrincipal other);
 107
 108     /**
 109      * Same as the previous method, subsumes(), but for codebase principals
 110      * ignores changes to document.domain.
 111      */
 112     boolean subsumesIgnoringDomain(in nsIPrincipal other);
 113
 114     %{C++
 115     inline bool Subsumes(nsIPrincipal* aOther) {
 116       bool subsumes = false;
 117       return NS_SUCCEEDED(Subsumes(aOther, &subsumes)) && subsumes;
 118     }
 119
 120     inline bool SubsumesIgnoringDomain(nsIPrincipal* aOther) {
 121       bool subsumes = false;
 122       return NS_SUCCEEDED(SubsumesIgnoringDomain(aOther, &subsumes)) && subsumes;
 123     }
 124     %}
 125
 126     /**
 127      * Checks whether this principal is allowed to load the network resource
 128      * located at the given URI under the same-origin policy. This means that
 129      * codebase principals are only allowed to load resources from the same
 130      * domain, the system principal is allowed to load anything, and null
 131      * principals are not allowed to load anything. This is changed slightly
 132      * by the optional flag allowIfInheritsPrincipal (which defaults to false)
 133      * which allows the load of a data: URI (which inherits the principal of
 134      * its loader) or a URI with the same principal as its loader (eg. a
 135      * Blob URI).
 136      * In these cases, with allowIfInheritsPrincipal set to true, the URI can
 137      * be loaded by a null principal.
 138      *
 139      * If the load is allowed this function does nothing. If the load is not
 140      * allowed the function throws NS_ERROR_DOM_BAD_URI.
 141      *
 142      * NOTE: Other policies might override this, such as the Access-Control
 143      *       specification.
 144      * NOTE: The 'domain' attribute has no effect on the behaviour of this
 145      *       function.
 146      *
 147      *
 148      * @param uri    The URI about to be loaded.
 149      * @param report If true, will report a warning to the console service
 150      *               if the load is not allowed.
 151      * @param allowIfInheritsPrincipal   If true, the load is allowed if the
 152      *                                   loadee inherits the principal of the
 153      *                                   loader.
 154      * @throws NS_ERROR_DOM_BAD_URI if the load is not allowed.
 155      */
 156     void checkMayLoad(in nsIURI uri, in boolean report,
 157                       in boolean allowIfInheritsPrincipal);
 158
 159     /**
 160      * A Content Security Policy associated with this principal.
 161      */
 162     [noscript] attribute nsIContentSecurityPolicy csp;
 163
 164     /**
 165      * Returns the jar prefix of the principal.
 166      * The jar prefix is a string that can be used to isolate data or
 167      * permissions between different principals while taking into account
 168      * parameters like the app id or the fact that the principal is embedded in
 169      * a mozbrowser.
 170      * Some principals will return an empty string.
 171      * Some principals will assert if you try to access the jarPrefix.
 172      *
 173      * The jarPrefix is intended to be an opaque identifier. It is currently
 174      * "human-readable" but no callers should assume it will stay as is and
 175      * it might be crypto-hashed at some point.
 176      */
 177     readonly attribute AUTF8String jarPrefix;
 178
 179     /**
 180      * The base domain of the codebase URI to which this principal pertains
 181      * (generally the document URI), handling null principals and
 182      * non-hierarchical schemes correctly.
 183      */
 184     readonly attribute ACString baseDomain;
 185
 186     const short APP_STATUS_NOT_INSTALLED = 0;
 187     const short APP_STATUS_INSTALLED     = 1;
 188     const short APP_STATUS_PRIVILEGED    = 2;
 189     const short APP_STATUS_CERTIFIED     = 3;
 190
 191     /**
 192      * Gets the principal's app status, which indicates whether the principal
 193      * corresponds to "app code", and if it does, how privileged that code is.
 194      * This method returns one of the APP_STATUS constants above.
 195      *
 196      * Note that a principal may have
 197      *
 198      *   appId != nsIScriptSecurityManager::NO_APP_ID &&
 199      *   appId != nsIScriptSecurityManager::UNKNOWN_APP_ID
 200      *
 201      * and still have appStatus == APP_STATUS_NOT_INSTALLED.  That's because
 202      * appId identifies the app that contains this principal, but a window
 203      * might be contained in an app and not be running code that the app has
 204      * vouched for.  For example, the window might be inside an <iframe
 205      * mozbrowser>, or the window's origin might not match the app's origin.
 206      *
 207      * If you're doing a check to determine "does this principal correspond to
 208      * app code?", you must check appStatus; checking appId != NO_APP_ID is not
 209      * sufficient.
 210      */
 211     [infallible] readonly attribute unsigned short appStatus;
 212
 213     /**
 214      * Gets the id of the app this principal is inside.  If this principal is
 215      * not inside an app, returns nsIScriptSecurityManager::NO_APP_ID.
 216      *
 217      * Note that this principal does not necessarily have the permissions of
 218      * the app identified by appId.  For example, this principal might
 219      * correspond to an iframe whose origin differs from that of the app frame
 220      * containing it.  In this case, the iframe will have the appId of its
 221      * containing app frame, but the iframe must not run with the app's
 222      * permissions.
 223      *
 224      * Similarly, this principal might correspond to an <iframe mozbrowser>
 225      * inside an app frame; in this case, the content inside the iframe should
 226      * not have any of the app's permissions, even if the iframe is at the same
 227      * origin as the app.
 228      *
 229      * If you're doing a security check based on appId, you must check
 230      * appStatus as well.
 231      */
 232     [infallible] readonly attribute unsigned long appId;
 233
 234     /**
 235      * Returns true iff the principal is inside a browser element.  (<iframe
 236      * mozbrowser mozapp> does not count as a browser element.)
 237      */
 238     [infallible] readonly attribute boolean isInBrowserElement;
 239
 240     /**
 241      * Returns true if this principal has an unknown appId. This shouldn't
 242      * generally be used. We only expose it due to not providing the correct
 243      * appId everywhere where we construct principals.
 244      */
 245     [infallible] readonly attribute boolean unknownAppId;
 246
 247     /**
 248      * Returns true iff this principal is a null principal (corresponding to an
 249      * unknown, hence assumed minimally privileged, security context).
 250      */
 251     [infallible] readonly attribute boolean isNullPrincipal;
 252 };
 253
 254 /**
 255  * If nsSystemPrincipal is too risky to use, but we want a principal to access
 256  * more than one origin, nsExpandedPrincipals letting us define an array of
 257  * principals it subsumes. So script with an nsExpandedPrincipals will gain
 258  * same origin access when at least one of its principals it contains gained
 259  * sameorigin acccess. An nsExpandedPrincipal will be subsumed by the system
 260  * principal, and by another nsExpandedPrincipal that has all its principals.
 261  * It is added for jetpack content-scripts to let them interact with the
 262  * content and a well defined set of other domains, without the risk of
 263  * leaking out a system principal to the content. See: Bug 734891
 264  */
 265 [uuid(f3e177Df-6a5e-489f-80a7-2dd1481471d8)]
 266 interface nsIExpandedPrincipal : nsISupports
 267 {
 268   /**
 269    * An array of principals that the expanded principal subsumes.
 270    * Note: this list is not reference counted, it is shared, so
 271    * should not be changed and should only be used ephemerally.
 272    */
 273   [noscript] readonly attribute PrincipalArray whiteList;
 274 };