dom/security/nsContentSecurityUtils.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 /* A namespace class for static content security utilities. */
   8
   9 #ifndef nsContentSecurityUtils_h___
  10 #define nsContentSecurityUtils_h___
  11
  12 #include <utility>
  13 #include "mozilla/Maybe.h"
  14 #include "nsStringFwd.h"
  15
  16 struct JSContext;
  17 class nsIChannel;
  18 class nsIHttpChannel;
  19 class nsIPrincipal;
  20 class NS_ConvertUTF8toUTF16;
  21
  22 namespace mozilla::dom {
  23 class Document;
  24 }  // namespace mozilla::dom
  25
  26 using FilenameTypeAndDetails = std::pair<nsCString, mozilla::Maybe<nsString>>;
  27
  28 class nsContentSecurityUtils {
  29  public:
  30   // CSPs upgrade-insecure-requests directive applies to same origin top level
  31   // navigations. Using the SOP would return false for the case when an https
  32   // page triggers and http page to load, even though that http page would be
  33   // upgraded to https later. Hence we have to use that custom function instead
  34   // of simply calling aTriggeringPrincipal->Equals(aResultPrincipal).
  35   static bool IsConsideredSameOriginForUIR(nsIPrincipal* aTriggeringPrincipal,
  36                                            nsIPrincipal* aResultPrincipal);
  37
  38   static bool IsEvalAllowed(JSContext* cx, bool aIsSystemPrincipal,
  39                             const nsAString& aScript);
  40   static void NotifyEvalUsage(bool aIsSystemPrincipal,
  41                               NS_ConvertUTF8toUTF16& aFileNameA,
  42                               uint64_t aWindowID, uint32_t aLineNumber,
  43                               uint32_t aColumnNumber);
  44
  45   // Helper function for various checks:
  46   // This function detects profiles with userChrome.js or extension signatures
  47   // disabled. We can't/won't enforce strong security for people with those
  48   // hacks. The function will cache its result.
  49   static void DetectJsHacks();
  50   // Helper function for detecting custom agent styles
  51   static void DetectCssHacks();
  52
  53   // Helper function to query the HTTP Channel of a potential
  54   // multi-part channel. Mostly used for querying response headers
  55   static nsresult GetHttpChannelFromPotentialMultiPart(
  56       nsIChannel* aChannel, nsIHttpChannel** aHttpChannel);
  57
  58   // Helper function which performs the following framing checks
  59   // * CSP frame-ancestors
  60   // * x-frame-options
  61   // If any of the two disallows framing, the channel will be cancelled.
  62   static void PerformCSPFrameAncestorAndXFOCheck(nsIChannel* aChannel);
  63
  64   // Helper function which just checks if the channel violates any:
  65   // 1. CSP frame-ancestors properties
  66   // 2. x-frame-options
  67   static bool CheckCSPFrameAncestorAndXFO(nsIChannel* aChannel);
  68
  69   // Helper function to Check if a Download is allowed;
  70   static long ClassifyDownload(nsIChannel* aChannel,
  71                                const nsAutoCString& aMimeTypeGuess);
  72
  73   // Public only for testing
  74   static FilenameTypeAndDetails FilenameToFilenameType(
  75       const nsString& fileName, bool collectAdditionalExtensionData);
  76   static char* SmartFormatCrashString(const char* str);
  77   static char* SmartFormatCrashString(char* str);
  78   static nsCString SmartFormatCrashString(const char* part1, const char* part2,
  79                                           const char* format_string);
  80   static nsCString SmartFormatCrashString(char* part1, char* part2,
  81                                           const char* format_string);
  82
  83 #if defined(DEBUG)
  84   static void AssertAboutPageHasCSP(mozilla::dom::Document* aDocument);
  85 #endif
  86
  87   static bool ValidateScriptFilename(JSContext* cx, const char* aFilename);
  88   // Helper Function to Post a message to the corresponding JS-Console
  89   static void LogMessageToConsole(nsIHttpChannel* aChannel, const char* aMsg);
  90 };
  91
  92 #endif /* nsContentSecurityUtils_h___ */