dlls/mshtml/secmgr.c

   1 /*
   2  * Copyright 2009 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20 #include <stdio.h>
  21 #include <assert.h>
  22
  23 #define COBJMACROS
  24
  25 #include "windef.h"
  26 #include "winbase.h"
  27 #include "winuser.h"
  28 #include "ole2.h"
  29 #include "activscp.h"
  30
  31 #include "wine/debug.h"
  32
  33 #include "mshtml_private.h"
  34
  35 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  36
  37 /* Defined as extern in urlmon.idl, but not exported by uuid.lib */
  38 DECLSPEC_HIDDEN const GUID GUID_CUSTOM_CONFIRMOBJECTSAFETY =
  39     {0x10200490,0xfa38,0x11d0,{0xac,0x0e,0x00,0xa0,0xc9,0xf,0xff,0xc0}};
  40
  41 static inline HTMLDocumentNode *impl_from_IInternetHostSecurityManager(IInternetHostSecurityManager *iface)
  42 {
  43     return CONTAINING_RECORD(iface, HTMLDocumentNode, IInternetHostSecurityManager_iface);
  44 }
  45
  46 static HRESULT WINAPI InternetHostSecurityManager_QueryInterface(IInternetHostSecurityManager *iface, REFIID riid, void **ppv)
  47 {
  48     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  49     return IHTMLDOMNode_QueryInterface(&This->node.IHTMLDOMNode_iface, riid, ppv);
  50 }
  51
  52 static ULONG WINAPI InternetHostSecurityManager_AddRef(IInternetHostSecurityManager *iface)
  53 {
  54     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  55     return IHTMLDOMNode_AddRef(&This->node.IHTMLDOMNode_iface);
  56 }
  57
  58 static ULONG WINAPI InternetHostSecurityManager_Release(IInternetHostSecurityManager *iface)
  59 {
  60     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  61     return IHTMLDOMNode_Release(&This->node.IHTMLDOMNode_iface);
  62 }
  63
  64 static HRESULT WINAPI InternetHostSecurityManager_GetSecurityId(IInternetHostSecurityManager *iface,  BYTE *pbSecurityId,
  65         DWORD *pcbSecurityId, DWORD_PTR dwReserved)
  66 {
  67     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  68     FIXME("(%p)->(%p %p %lx)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
  69     return E_NOTIMPL;
  70 }
  71
  72 static HRESULT WINAPI InternetHostSecurityManager_ProcessUrlAction(IInternetHostSecurityManager *iface, DWORD dwAction,
  73         BYTE *pPolicy, DWORD cbPolicy, BYTE *pContext, DWORD cbContext, DWORD dwFlags, DWORD dwReserved)
  74 {
  75     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  76     const WCHAR *url;
  77
  78     TRACE("(%p)->(%d %p %d %p %d %x %x)\n", This, dwAction, pPolicy, cbPolicy, pContext, cbContext, dwFlags, dwReserved);
  79
  80     if(!This->basedoc.window)
  81         return E_UNEXPECTED;
  82
  83     url = This->basedoc.window->url ? This->basedoc.window->url : L"about:blank";
  84
  85     return IInternetSecurityManager_ProcessUrlAction(get_security_manager(), url, dwAction, pPolicy, cbPolicy,
  86             pContext, cbContext, dwFlags, dwReserved);
  87 }
  88
  89 static HRESULT confirm_safety_load(HTMLDocumentNode *This, struct CONFIRMSAFETY *cs, DWORD *ret)
  90 {
  91     IObjectSafety *obj_safety;
  92     HRESULT hres;
  93
  94     hres = IUnknown_QueryInterface(cs->pUnk, &IID_IObjectSafety, (void**)&obj_safety);
  95     if(SUCCEEDED(hres)) {
  96         hres = IObjectSafety_SetInterfaceSafetyOptions(obj_safety, &IID_IDispatch,
  97                 INTERFACESAFE_FOR_UNTRUSTED_DATA, INTERFACESAFE_FOR_UNTRUSTED_DATA);
  98         IObjectSafety_Release(obj_safety);
  99         *ret = SUCCEEDED(hres) ? URLPOLICY_ALLOW : URLPOLICY_DISALLOW;
 100     }else {
 101         CATID init_catid = CATID_SafeForInitializing;
 102
 103         hres = ICatInformation_IsClassOfCategories(This->catmgr, &cs->clsid, 1, &init_catid, 0, NULL);
 104         assert(SUCCEEDED(hres));
 105         *ret = hres == S_OK ? URLPOLICY_ALLOW : URLPOLICY_DISALLOW;
 106     }
 107
 108     return S_OK;
 109 }
 110
 111 static HRESULT confirm_safety(HTMLDocumentNode *This, const WCHAR *url, struct CONFIRMSAFETY *cs, DWORD *ret)
 112 {
 113     DWORD policy, enabled_opts, supported_opts;
 114     IObjectSafety *obj_safety;
 115     HRESULT hres;
 116
 117     TRACE("%s %p %s\n", debugstr_w(url), cs->pUnk, debugstr_guid(&cs->clsid));
 118
 119     /* FIXME: Check URLACTION_ACTIVEX_OVERRIDE_SCRIPT_SAFETY */
 120
 121     hres = IInternetSecurityManager_ProcessUrlAction(get_security_manager(), url, URLACTION_SCRIPT_SAFE_ACTIVEX,
 122             (BYTE*)&policy, sizeof(policy), NULL, 0, 0, 0);
 123     if(FAILED(hres) || policy != URLPOLICY_ALLOW) {
 124         *ret = URLPOLICY_DISALLOW;
 125         return S_OK;
 126     }
 127
 128     hres = IUnknown_QueryInterface(cs->pUnk, &IID_IObjectSafety, (void**)&obj_safety);
 129     if(SUCCEEDED(hres)) {
 130         hres = IObjectSafety_GetInterfaceSafetyOptions(obj_safety, &IID_IDispatchEx, &supported_opts, &enabled_opts);
 131         if(FAILED(hres))
 132             supported_opts = 0;
 133
 134         enabled_opts = INTERFACESAFE_FOR_UNTRUSTED_CALLER;
 135         if(supported_opts & INTERFACE_USES_SECURITY_MANAGER)
 136             enabled_opts |= INTERFACE_USES_SECURITY_MANAGER;
 137
 138         hres = IObjectSafety_SetInterfaceSafetyOptions(obj_safety, &IID_IDispatchEx, enabled_opts, enabled_opts);
 139         if(FAILED(hres)) {
 140             enabled_opts &= ~INTERFACE_USES_SECURITY_MANAGER;
 141             hres = IObjectSafety_SetInterfaceSafetyOptions(obj_safety, &IID_IDispatch, enabled_opts, enabled_opts);
 142         }
 143         IObjectSafety_Release(obj_safety);
 144
 145         if(FAILED(hres)) {
 146             *ret = URLPOLICY_DISALLOW;
 147             return S_OK;
 148         }
 149     }else {
 150         CATID scripting_catid = CATID_SafeForScripting;
 151
 152         if(!This->catmgr) {
 153             hres = CoCreateInstance(&CLSID_StdComponentCategoriesMgr, NULL, CLSCTX_INPROC_SERVER,
 154                     &IID_ICatInformation, (void**)&This->catmgr);
 155             if(FAILED(hres))
 156                 return hres;
 157         }
 158
 159         hres = ICatInformation_IsClassOfCategories(This->catmgr, &cs->clsid, 1, &scripting_catid, 0, NULL);
 160         if(FAILED(hres))
 161             return hres;
 162
 163         if(hres != S_OK) {
 164             *ret = URLPOLICY_DISALLOW;
 165             return S_OK;
 166         }
 167     }
 168
 169     if(cs->dwFlags & CONFIRMSAFETYACTION_LOADOBJECT)
 170         return confirm_safety_load(This, cs, ret);
 171
 172     *ret = URLPOLICY_ALLOW;
 173     return S_OK;
 174 }
 175
 176 static HRESULT WINAPI InternetHostSecurityManager_QueryCustomPolicy(IInternetHostSecurityManager *iface, REFGUID guidKey,
 177         BYTE **ppPolicy, DWORD *pcbPolicy, BYTE *pContext, DWORD cbContext, DWORD dwReserved)
 178 {
 179     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
 180     const WCHAR *url;
 181     HRESULT hres;
 182
 183     TRACE("(%p)->(%s %p %p %p %d %x)\n", This, debugstr_guid(guidKey), ppPolicy, pcbPolicy, pContext, cbContext, dwReserved);
 184
 185     if(!This->basedoc.window)
 186         return E_UNEXPECTED;
 187
 188     url = This->basedoc.window->url ? This->basedoc.window->url : L"about:blank";
 189
 190     hres = IInternetSecurityManager_QueryCustomPolicy(get_security_manager(), url, guidKey, ppPolicy, pcbPolicy,
 191             pContext, cbContext, dwReserved);
 192     if(hres != HRESULT_FROM_WIN32(ERROR_NOT_FOUND))
 193         return hres;
 194
 195     if(IsEqualGUID(&GUID_CUSTOM_CONFIRMOBJECTSAFETY, guidKey)) {
 196         IActiveScript *active_script;
 197         struct CONFIRMSAFETY *cs;
 198         DWORD policy;
 199
 200         if(cbContext != sizeof(struct CONFIRMSAFETY)) {
 201             FIXME("wrong context size\n");
 202             return E_FAIL;
 203         }
 204
 205         cs = (struct CONFIRMSAFETY*)pContext;
 206         TRACE("cs = {%s %p %x}\n", debugstr_guid(&cs->clsid), cs->pUnk, cs->dwFlags);
 207
 208         hres = IUnknown_QueryInterface(cs->pUnk, &IID_IActiveScript, (void**)&active_script);
 209         if(SUCCEEDED(hres)) {
 210             FIXME("Got IAciveScript iface\n");
 211             IActiveScript_Release(active_script);
 212             return E_FAIL;
 213         }
 214
 215         hres = confirm_safety(This, url, cs, &policy);
 216         if(FAILED(hres))
 217             return hres;
 218
 219         *ppPolicy = CoTaskMemAlloc(sizeof(policy));
 220         if(!*ppPolicy)
 221             return E_OUTOFMEMORY;
 222
 223         *(DWORD*)*ppPolicy = policy;
 224         *pcbPolicy = sizeof(policy);
 225         TRACE("policy %x\n", policy);
 226         return S_OK;
 227     }
 228
 229     FIXME("Unknown guidKey %s\n", debugstr_guid(guidKey));
 230     return hres;
 231 }
 232
 233 static const IInternetHostSecurityManagerVtbl InternetHostSecurityManagerVtbl = {
 234     InternetHostSecurityManager_QueryInterface,
 235     InternetHostSecurityManager_AddRef,
 236     InternetHostSecurityManager_Release,
 237     InternetHostSecurityManager_GetSecurityId,
 238     InternetHostSecurityManager_ProcessUrlAction,
 239     InternetHostSecurityManager_QueryCustomPolicy
 240 };
 241
 242 void HTMLDocumentNode_SecMgr_Init(HTMLDocumentNode *This)
 243 {
 244     This->IInternetHostSecurityManager_iface.lpVtbl = &InternetHostSecurityManagerVtbl;
 245 }