dlls/mshtml/secmgr.c

   1 /*
   2  * Copyright 2009 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20 #include <stdio.h>
  21
  22 #define COBJMACROS
  23
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "winuser.h"
  27 #include "ole2.h"
  28 #include "activscp.h"
  29
  30 #include "wine/debug.h"
  31
  32 #include "mshtml_private.h"
  33
  34 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  35
  36 /* Defined as extern in urlmon.idl, but not exported by uuid.lib */
  37 const GUID GUID_CUSTOM_CONFIRMOBJECTSAFETY =
  38     {0x10200490,0xfa38,0x11d0,{0xac,0x0e,0x00,0xa0,0xc9,0xf,0xff,0xc0}};
  39
  40 static inline HTMLDocumentNode *impl_from_IInternetHostSecurityManager(IInternetHostSecurityManager *iface)
  41 {
  42     return CONTAINING_RECORD(iface, HTMLDocumentNode, IInternetHostSecurityManager_iface);
  43 }
  44
  45 static HRESULT WINAPI InternetHostSecurityManager_QueryInterface(IInternetHostSecurityManager *iface, REFIID riid, void **ppv)
  46 {
  47     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  48     return IHTMLDOMNode_QueryInterface(&This->node.IHTMLDOMNode_iface, riid, ppv);
  49 }
  50
  51 static ULONG WINAPI InternetHostSecurityManager_AddRef(IInternetHostSecurityManager *iface)
  52 {
  53     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  54     return IHTMLDOMNode_AddRef(&This->node.IHTMLDOMNode_iface);
  55 }
  56
  57 static ULONG WINAPI InternetHostSecurityManager_Release(IInternetHostSecurityManager *iface)
  58 {
  59     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  60     return IHTMLDOMNode_Release(&This->node.IHTMLDOMNode_iface);
  61 }
  62
  63 static HRESULT WINAPI InternetHostSecurityManager_GetSecurityId(IInternetHostSecurityManager *iface,  BYTE *pbSecurityId,
  64         DWORD *pcbSecurityId, DWORD_PTR dwReserved)
  65 {
  66     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  67     FIXME("(%p)->(%p %p %Ix)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
  68     return E_NOTIMPL;
  69 }
  70
  71 static HRESULT WINAPI InternetHostSecurityManager_ProcessUrlAction(IInternetHostSecurityManager *iface, DWORD dwAction,
  72         BYTE *pPolicy, DWORD cbPolicy, BYTE *pContext, DWORD cbContext, DWORD dwFlags, DWORD dwReserved)
  73 {
  74     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
  75     const WCHAR *url;
  76
  77     TRACE("(%p)->(%ld %p %ld %p %ld %lx %lx)\n", This, dwAction, pPolicy, cbPolicy, pContext, cbContext, dwFlags, dwReserved);
  78
  79     if(!This->window || !This->window->base.outer_window)
  80         return E_UNEXPECTED;
  81
  82     url = This->window->base.outer_window->url ? This->window->base.outer_window->url : L"about:blank";
  83
  84     return IInternetSecurityManager_ProcessUrlAction(get_security_manager(), url, dwAction, pPolicy, cbPolicy,
  85             pContext, cbContext, dwFlags, dwReserved);
  86 }
  87
  88 static HRESULT confirm_safety_load(HTMLDocumentNode *This, struct CONFIRMSAFETY *cs, DWORD *ret)
  89 {
  90     IObjectSafety *obj_safety;
  91     HRESULT hres;
  92
  93     hres = IUnknown_QueryInterface(cs->pUnk, &IID_IObjectSafety, (void**)&obj_safety);
  94     if(SUCCEEDED(hres)) {
  95         hres = IObjectSafety_SetInterfaceSafetyOptions(obj_safety, &IID_IDispatch,
  96                 INTERFACESAFE_FOR_UNTRUSTED_DATA, INTERFACESAFE_FOR_UNTRUSTED_DATA);
  97         IObjectSafety_Release(obj_safety);
  98         *ret = SUCCEEDED(hres) ? URLPOLICY_ALLOW : URLPOLICY_DISALLOW;
  99     }else {
 100         CATID init_catid = CATID_SafeForInitializing;
 101
 102         hres = ICatInformation_IsClassOfCategories(This->catmgr, &cs->clsid, 1, &init_catid, 0, NULL);
 103         assert(SUCCEEDED(hres));
 104         *ret = hres == S_OK ? URLPOLICY_ALLOW : URLPOLICY_DISALLOW;
 105     }
 106
 107     return S_OK;
 108 }
 109
 110 static HRESULT confirm_safety(HTMLDocumentNode *This, const WCHAR *url, struct CONFIRMSAFETY *cs, DWORD *ret)
 111 {
 112     DWORD policy, enabled_opts, supported_opts;
 113     IObjectSafety *obj_safety;
 114     HRESULT hres;
 115
 116     TRACE("%s %p %s\n", debugstr_w(url), cs->pUnk, debugstr_guid(&cs->clsid));
 117
 118     /* FIXME: Check URLACTION_ACTIVEX_OVERRIDE_SCRIPT_SAFETY */
 119
 120     hres = IInternetSecurityManager_ProcessUrlAction(get_security_manager(), url, URLACTION_SCRIPT_SAFE_ACTIVEX,
 121             (BYTE*)&policy, sizeof(policy), NULL, 0, 0, 0);
 122     if(FAILED(hres) || policy != URLPOLICY_ALLOW) {
 123         *ret = URLPOLICY_DISALLOW;
 124         return S_OK;
 125     }
 126
 127     hres = IUnknown_QueryInterface(cs->pUnk, &IID_IObjectSafety, (void**)&obj_safety);
 128     if(SUCCEEDED(hres)) {
 129         hres = IObjectSafety_GetInterfaceSafetyOptions(obj_safety, &IID_IDispatchEx, &supported_opts, &enabled_opts);
 130         if(FAILED(hres))
 131             supported_opts = 0;
 132
 133         enabled_opts = INTERFACESAFE_FOR_UNTRUSTED_CALLER;
 134         if(supported_opts & INTERFACE_USES_SECURITY_MANAGER)
 135             enabled_opts |= INTERFACE_USES_SECURITY_MANAGER;
 136
 137         hres = IObjectSafety_SetInterfaceSafetyOptions(obj_safety, &IID_IDispatchEx, enabled_opts, enabled_opts);
 138         if(FAILED(hres)) {
 139             enabled_opts &= ~INTERFACE_USES_SECURITY_MANAGER;
 140             hres = IObjectSafety_SetInterfaceSafetyOptions(obj_safety, &IID_IDispatch, enabled_opts, enabled_opts);
 141         }
 142         IObjectSafety_Release(obj_safety);
 143
 144         if(FAILED(hres)) {
 145             *ret = URLPOLICY_DISALLOW;
 146             return S_OK;
 147         }
 148     }else {
 149         CATID scripting_catid = CATID_SafeForScripting;
 150
 151         if(!This->catmgr) {
 152             hres = CoCreateInstance(&CLSID_StdComponentCategoriesMgr, NULL, CLSCTX_INPROC_SERVER,
 153                     &IID_ICatInformation, (void**)&This->catmgr);
 154             if(FAILED(hres))
 155                 return hres;
 156         }
 157
 158         hres = ICatInformation_IsClassOfCategories(This->catmgr, &cs->clsid, 1, &scripting_catid, 0, NULL);
 159         if(FAILED(hres))
 160             return hres;
 161
 162         if(hres != S_OK) {
 163             *ret = URLPOLICY_DISALLOW;
 164             return S_OK;
 165         }
 166     }
 167
 168     if(cs->dwFlags & CONFIRMSAFETYACTION_LOADOBJECT)
 169         return confirm_safety_load(This, cs, ret);
 170
 171     *ret = URLPOLICY_ALLOW;
 172     return S_OK;
 173 }
 174
 175 static HRESULT WINAPI InternetHostSecurityManager_QueryCustomPolicy(IInternetHostSecurityManager *iface, REFGUID guidKey,
 176         BYTE **ppPolicy, DWORD *pcbPolicy, BYTE *pContext, DWORD cbContext, DWORD dwReserved)
 177 {
 178     HTMLDocumentNode *This = impl_from_IInternetHostSecurityManager(iface);
 179     const WCHAR *url;
 180     HRESULT hres;
 181
 182     TRACE("(%p)->(%s %p %p %p %ld %lx)\n", This, debugstr_guid(guidKey), ppPolicy, pcbPolicy, pContext, cbContext, dwReserved);
 183
 184     if(!This->window || !This->window->base.outer_window)
 185         return E_UNEXPECTED;
 186
 187     url = This->window->base.outer_window->url ? This->window->base.outer_window->url : L"about:blank";
 188
 189     hres = IInternetSecurityManager_QueryCustomPolicy(get_security_manager(), url, guidKey, ppPolicy, pcbPolicy,
 190             pContext, cbContext, dwReserved);
 191     if(hres != HRESULT_FROM_WIN32(ERROR_NOT_FOUND))
 192         return hres;
 193
 194     if(IsEqualGUID(&GUID_CUSTOM_CONFIRMOBJECTSAFETY, guidKey)) {
 195         IActiveScript *active_script;
 196         struct CONFIRMSAFETY *cs;
 197         DWORD policy;
 198
 199         if(cbContext != sizeof(struct CONFIRMSAFETY)) {
 200             FIXME("wrong context size\n");
 201             return E_FAIL;
 202         }
 203
 204         cs = (struct CONFIRMSAFETY*)pContext;
 205         TRACE("cs = {%s %p %lx}\n", debugstr_guid(&cs->clsid), cs->pUnk, cs->dwFlags);
 206
 207         hres = IUnknown_QueryInterface(cs->pUnk, &IID_IActiveScript, (void**)&active_script);
 208         if(SUCCEEDED(hres)) {
 209             FIXME("Got IAciveScript iface\n");
 210             IActiveScript_Release(active_script);
 211             return E_FAIL;
 212         }
 213
 214         hres = confirm_safety(This, url, cs, &policy);
 215         if(FAILED(hres))
 216             return hres;
 217
 218         *ppPolicy = CoTaskMemAlloc(sizeof(policy));
 219         if(!*ppPolicy)
 220             return E_OUTOFMEMORY;
 221
 222         *(DWORD*)*ppPolicy = policy;
 223         *pcbPolicy = sizeof(policy);
 224         TRACE("policy %lx\n", policy);
 225         return S_OK;
 226     }
 227
 228     FIXME("Unknown guidKey %s\n", debugstr_guid(guidKey));
 229     return hres;
 230 }
 231
 232 static const IInternetHostSecurityManagerVtbl InternetHostSecurityManagerVtbl = {
 233     InternetHostSecurityManager_QueryInterface,
 234     InternetHostSecurityManager_AddRef,
 235     InternetHostSecurityManager_Release,
 236     InternetHostSecurityManager_GetSecurityId,
 237     InternetHostSecurityManager_ProcessUrlAction,
 238     InternetHostSecurityManager_QueryCustomPolicy
 239 };
 240
 241 void HTMLDocumentNode_SecMgr_Init(HTMLDocumentNode *This)
 242 {
 243     This->IInternetHostSecurityManager_iface.lpVtbl = &InternetHostSecurityManagerVtbl;
 244 }