caps/idl/nsIScriptSecurityManager.idl

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* ***** BEGIN LICENSE BLOCK *****
   3  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   4  *
   5  * The contents of this file are subject to the Mozilla Public License Version
   6  * 1.1 (the "License"); you may not use this file except in compliance with
   7  * the License. You may obtain a copy of the License at
   8  * http://www.mozilla.org/MPL/
   9  *
  10  * Software distributed under the License is distributed on an "AS IS" basis,
  11  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  12  * for the specific language governing rights and limitations under the
  13  * License.
  14  *
  15  * The Original Code is mozilla.org code.
  16  *
  17  * The Initial Developer of the Original Code is
  18  * Netscape Communications Corporation.
  19  * Portions created by the Initial Developer are Copyright (C) 1999
  20  * the Initial Developer. All Rights Reserved.
  21  *
  22  * Contributor(s):
  23  *
  24  * Alternatively, the contents of this file may be used under the terms of
  25  * either of the GNU General Public License Version 2 or later (the "GPL"),
  26  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  27  * in which case the provisions of the GPL or the LGPL are applicable instead
  28  * of those above. If you wish to allow use of your version of this file only
  29  * under the terms of either the GPL or the LGPL, and not to allow others to
  30  * use your version of this file under the terms of the MPL, indicate your
  31  * decision by deleting the provisions above and replace them with the notice
  32  * and other provisions required by the GPL or the LGPL. If you do not delete
  33  * the provisions above, a recipient may use your version of this file under
  34  * the terms of any one of the MPL, the GPL or the LGPL.
  35  *
  36  * ***** END LICENSE BLOCK ***** */
  37
  38 #include "nsISupports.idl"
  39 #include "nsIPrincipal.idl"
  40 #include "nsIXPCSecurityManager.idl"
  41 interface nsIURI;
  42 interface nsIChannel;
  43
  44 [scriptable, uuid(50eda256-4dd2-4c7c-baed-96983910af9f)]
  45 interface nsIScriptSecurityManager : nsIXPCSecurityManager
  46 {
  47     ///////////////// Security Checks //////////////////
  48     /**
  49      * Checks whether the running script is allowed to access aProperty.
  50      */
  51     [noscript] void checkPropertyAccess(in JSContextPtr aJSContext,
  52                                         in JSObjectPtr aJSObject,
  53                                         in string aClassName,
  54                                         in jsval aProperty,
  55                                         in PRUint32 aAction);
  56
  57     /**
  58      * Check that the script currently running in context "cx" can load "uri".
  59      *
  60      * Will return error code NS_ERROR_DOM_BAD_URI if the load request
  61      * should be denied.
  62      *
  63      * @param cx the JSContext of the script causing the load
  64      * @param uri the URI that is being loaded
  65      */
  66     [noscript] void checkLoadURIFromScript(in JSContextPtr cx, in nsIURI uri);
  67
  68     /**
  69      * Default CheckLoadURI permissions
  70      */
  71     // Default permissions
  72     const unsigned long STANDARD = 0;
  73
  74     // Indicate that the load is a load of a new document that is not
  75     // user-triggered.  Here "user-triggered" could be broadly interpreted --
  76     // for example, scripted sets of window.location.href might be treated as
  77     // "user-triggered" in some circumstances.  A typical example of a load
  78     // that is not user-triggered is a <meta> refresh load.  If this flag is
  79     // set, the load will be denied if the originating principal's URI has the
  80     // nsIProtocolHandler::URI_FORBIDS_AUTOMATIC_DOCUMENT_REPLACEMENT flag set.
  81     const unsigned long LOAD_IS_AUTOMATIC_DOCUMENT_REPLACEMENT = 1 << 0;
  82
  83     // Allow the loading of chrome URLs by non-chrome URLs.  Use with great
  84     // care!  This will actually allow the loading of any URI which has the
  85     // nsIProtocolHandler::URI_IS_UI_RESOURCE protocol handler flag set.  Ths
  86     // probably means at least chrome: and resource:.
  87     const unsigned long ALLOW_CHROME = 1 << 1;
  88
  89     // Don't allow URLs which would inherit the caller's principal (such as
  90     // javascript: or data:) to load.  See
  91     // nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT.
  92     const unsigned long DISALLOW_INHERIT_PRINCIPAL = 1 << 2;
  93
  94     // Alias for DISALLOW_INHERIT_PRINCIPAL for backwards compat with
  95     // JS-implemented extensions.
  96     const unsigned long DISALLOW_SCRIPT_OR_DATA = DISALLOW_INHERIT_PRINCIPAL;
  97
  98     // Don't allow javascript: URLs to load
  99     //   WARNING: Support for this value was added in Mozilla 1.7.8 and
 100     //   Firefox 1.0.4.  Use in prior versions WILL BE IGNORED.
 101     // When using this, make sure that you actually want DISALLOW_SCRIPT, not
 102     // DISALLOW_INHERIT_PRINCIPAL
 103     const unsigned long DISALLOW_SCRIPT = 1 << 3;
 104
 105     /**
 106      * Check that content with principal aPrincipal can load "uri".
 107      *
 108      * Will return error code NS_ERROR_DOM_BAD_URI if the load request
 109      * should be denied.
 110      *
 111      * @param aPrincipal the principal identifying the actor causing the load
 112      * @param uri the URI that is being loaded
 113      * @param flags the permission set, see above
 114      */
 115     void checkLoadURIWithPrincipal(in nsIPrincipal aPrincipal,
 116                                    in nsIURI uri,
 117                                    in unsigned long flags);
 118
 119     /**
 120      * Check that content from "from" can load "uri".
 121      *
 122      * Will return error code NS_ERROR_DOM_BAD_URI if the load request
 123      * should be denied.
 124      *
 125      * @param from the URI causing the load
 126      * @param uri the URI that is being loaded
 127      * @param flags the permission set, see above
 128      *
 129      * @deprecated Use checkLoadURIWithPrincipal instead of this function.
 130      */
 131     void checkLoadURI(in nsIURI from, in nsIURI uri,
 132                       in unsigned long flags);
 133
 134     /**
 135      * Similar to checkLoadURIWithPrincipal but there are two differences:
 136      *
 137      * 1) The URI is a string, not a URI object.
 138      * 2) This function assumes that the URI may still be subject to fixup (and
 139      * hence will check whether fixed-up versions of the URI are allowed to
 140      * load as well); if any of the versions of this URI is not allowed, this
 141      * function will return error code NS_ERROR_DOM_BAD_URI.
 142      */
 143     void checkLoadURIStrWithPrincipal(in nsIPrincipal aPrincipal,
 144                                       in AUTF8String uri,
 145                                       in unsigned long flags);
 146
 147     /**
 148      * Same as CheckLoadURI but takes string arguments for ease of use
 149      * by scripts
 150      *
 151      * @deprecated Use checkLoadURIStrWithPrincipal instead of this function.
 152      */
 153     void checkLoadURIStr(in AUTF8String from, in AUTF8String uri,
 154                          in unsigned long flags);
 155
 156     /**
 157      * Check that the function 'funObj' is allowed to run on 'targetObj'
 158      *
 159      * Will return error code NS_ERROR_DOM_SECURITY_ERR if the function
 160      * should not run
 161      *
 162      * @param cx The current active JavaScript context.
 163      * @param funObj The function trying to run..
 164      * @param targetObj The object the function will run on.
 165      */
 166     [noscript] void checkFunctionAccess(in JSContextPtr cx, in voidPtr funObj,
 167                                         in voidPtr targetObj);
 168
 169     /**
 170      * Return true if content from the given principal is allowed to
 171      * execute scripts.
 172      */
 173     [noscript] boolean canExecuteScripts(in JSContextPtr cx,
 174                                          in nsIPrincipal principal);
 175
 176     ///////////////// Principals ///////////////////////
 177     /**
 178      * Return the principal of the innermost frame of the currently
 179      * executing script. Will return null if there is no script
 180      * currently executing.
 181      */
 182     [noscript] nsIPrincipal getSubjectPrincipal();
 183
 184     /**
 185      * Return the all-powerful system principal.
 186      */
 187     [noscript] nsIPrincipal getSystemPrincipal();
 188
 189     /**
 190      * Return a principal with the specified certificate fingerprint, subject
 191      * name (the full name or concatenated set of names of the entity
 192      * represented by the certificate), pretty name, certificate, and
 193      * codebase URI.  The certificate fingerprint and subject name MUST be
 194      * nonempty; otherwise an error will be thrown.  Similarly, aCert must
 195      * not be null.
 196      */
 197     [noscript] nsIPrincipal
 198          getCertificatePrincipal(in AUTF8String aCertFingerprint,
 199                                  in AUTF8String aSubjectName,
 200                                  in AUTF8String aPrettyName,
 201                                  in nsISupports aCert,
 202                                  in nsIURI aURI);
 203
 204     /**
 205      * Return a principal that has the same origin as aURI.
 206      */
 207     nsIPrincipal getCodebasePrincipal(in nsIURI aURI);
 208
 209     ///////////////// Capabilities API /////////////////////
 210     /**
 211      * Request that 'capability' can be enabled by scripts or applets
 212      * running with 'principal'. Will prompt user if
 213      * necessary. Returns nsIPrincipal::ENABLE_GRANTED or
 214      * nsIPrincipal::ENABLE_DENIED based on user's choice.
 215      */
 216     [noscript] short requestCapability(in nsIPrincipal principal,
 217                                        in string capability);
 218
 219     /**
 220      * Return true if the currently executing script has 'capability' enabled.
 221      */
 222     boolean isCapabilityEnabled(in string capability);
 223
 224     /**
 225      * Enable 'capability' in the innermost frame of the currently executing
 226      * script.
 227      */
 228     void enableCapability(in string capability);
 229
 230     /**
 231      * Remove 'capability' from the innermost frame of the currently
 232      * executing script. Any setting of 'capability' from enclosing
 233      * frames thus comes into effect.
 234      */
 235     void revertCapability(in string capability);
 236
 237     /**
 238      * Disable 'capability' in the innermost frame of the currently executing
 239      * script.
 240      */
 241     void disableCapability(in string capability);
 242
 243     //////////////// Master Certificate Functions ////////////////////
 244     /**
 245      * Allow 'certificateID' to enable 'capability.' Can only be performed
 246      * by code signed by the system certificate.
 247      */
 248     // XXXbz Capabilities can't have non-ascii chars?
 249     // XXXbz ideally we'd pass a subjectName here too, and the nsISupports
 250     // cert we're enabling for...
 251     void setCanEnableCapability(in AUTF8String certificateFingerprint,
 252                                 in string capability,
 253                                 in short canEnable);
 254
 255     ///////////////////////
 256     /**
 257      * Return the principal of the specified object in the specified context.
 258      */
 259     [noscript] nsIPrincipal getObjectPrincipal(in JSContextPtr cx,
 260                                                in JSObjectPtr obj);
 261
 262     /**
 263      * Returns true if the principal of the currently running script is the
 264      * system principal, false otherwise.
 265      */
 266     [noscript] boolean subjectPrincipalIsSystem();
 267
 268     /**
 269      * Returns OK if aJSContext and target have the same "origin"
 270      * (scheme, host, and port).
 271      */
 272     [noscript] void checkSameOrigin(in JSContextPtr aJSContext,
 273                                     in nsIURI aTargetURI);
 274
 275     /**
 276      * Returns OK if aSourceURI and target have the same "origin"
 277      * (scheme, host, and port).
 278      * ReportError flag suppresses error reports for functions that
 279      * don't need reporting.
 280      */
 281     void checkSameOriginURI(in nsIURI aSourceURI,
 282                             in nsIURI aTargetURI,
 283                             in boolean reportError);
 284
 285     /**
 286      * Returns the principal of the global object of the given context, or null
 287      * if no global or no principal.
 288      */
 289     [noscript] nsIPrincipal getPrincipalFromContext(in JSContextPtr cx);
 290
 291     /**
 292      * Get the principal for the given channel.  This will typically be the
 293      * channel owner if there is one, and the codebase principal for the
 294      * channel's URI otherwise.  aChannel must not be null.
 295      */
 296     nsIPrincipal getChannelPrincipal(in nsIChannel aChannel);
 297
 298     /**
 299      * Check whether a given principal is a system principal.  This allows us
 300      * to avoid handing back the system principal to script while allowing
 301      * script to check whether a given principal is system.
 302      */
 303     boolean isSystemPrincipal(in nsIPrincipal aPrincipal);
 304
 305     /**
 306      * Same as getSubjectPrincipal(), only faster. cx must *never* be
 307      * passed null, and it must be the context on the top of the
 308      * context stack. Does *not* reference count the returned
 309      * principal.
 310      */
 311     [noscript,notxpcom] nsIPrincipal getCxSubjectPrincipal(in JSContextPtr cx);
 312     [noscript,notxpcom] nsIPrincipal getCxSubjectPrincipalAndFrame(in JSContextPtr cx,
 313                                                                    out JSStackFramePtr fp);
 314
 315     /**
 316      * If no scripted code is running "above" (or called from) fp, then
 317      * instead of looking at cx->globalObject, we will return |principal|.
 318      * This function only affects |cx|. If someone pushes another context onto
 319      * the context stack, then it supersedes this call.
 320      * NOTE: If |fp| is non-null popContextPrincipal must be called before fp
 321      * has finished executing.
 322      *
 323      * @param cx The context to clamp.
 324      * @param fp The frame pointer to clamp at. May be 'null'.
 325      * @param principal The principal to clamp to.
 326      */
 327     [noscript] void pushContextPrincipal(in JSContextPtr cx,
 328                                          in JSStackFramePtr fp,
 329                                          in nsIPrincipal principal);
 330
 331     /**
 332      * Removes a clamp set by pushContextPrincipal from cx. This must be
 333      * called in a stack-like fashion (e.g., given two contexts |a| and |b|,
 334      * it is not legal to do: push(a) push(b) pop(a)).
 335      */
 336     [noscript] void popContextPrincipal(in JSContextPtr cx);
 337 };
 338
 339 %{C++
 340 #define NS_SCRIPTSECURITYMANAGER_CONTRACTID "@mozilla.org/scriptsecuritymanager;1"
 341 #define NS_SCRIPTSECURITYMANAGER_CLASSNAME "scriptsecuritymanager"
 342 %}