Ziele Untersuchung
mit Columbo Integrität von
Datenbanken Interaktion und
Portierbarkeit Ergonomie der
Schnittstellen

Angebot Produkte Projekt Beratung

Mittel Analytik Modellierung Sprachen Algebra Logik Hardware Denken Kreativität

Zusammenhänge Gesellschaft Wirtschaft Branche Firma


products/sources/formale Sprachen/C/Firefox/dom/security/ (Browser von der Mozilla Stiftung Version 136.0.1^©) Datei vom 10.2.2025 mit Größe 5 kB

Quelle CSPEvalChecker.cpp Sprache: C

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "mozilla/dom/CSPEvalChecker.h"
#include "mozilla/dom/Document.h"
#include "mozilla/dom/WorkerPrivate.h"
#include "mozilla/dom/WorkerRunnable.h"
#include "mozilla/ErrorResult.h"
#include "nsGlobalWindowInner.h"
#include "nsContentSecurityUtils.h"
#include "nsContentUtils.h"
#include "nsCOMPtr.h"

using namespace mozilla;
using namespace mozilla::dom;

namespace {

// We use the subjectPrincipal to assert that eval() is never
// executed in system privileged context.
nsresult CheckInternal(nsIContentSecurityPolicy* aCSP,
                       nsICSPEventListener* aCSPEventListener,
                       nsIPrincipal* aSubjectPrincipal,
                       const nsAString& aExpression,
                       const JSCallingLocation& aCaller, bool* aAllowed) {
  MOZ_ASSERT(NS_IsMainThread(8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
  MOZ_ASSERT(aAllowed);

  // The value is set at any "return", but better to have a default value here.
  *aAllowed = false;

  // This is the non-CSP check for gating eval() use in the SystemPrincipal
#if !defined(ANDROID)
  JSContext* cx = nsContentUtils::GetCurrentJSContext();
  if (!nsContentSecurityUtils::IsEvalAllowed(
          cx, aSubjectPrincipal->IsSystemPrincipal(), aExpression)) {
    *aAllowed = false;
    return NS_OK;
  }
#endif

  if (!aCSP) {
    *aAllowed = true;
    return NS_OK;
  }

  bool reportViolation = false;
  nsresult rv = aCSP->GetAllowsEval(&reportViolation, aAllowed);
  if (NS_WARN_IF(NS_FAILED(rv))) {
    *aAllowed = false;
    return rv;
  }

  if (reportViolation) {
    aCSP->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
                              nullptr,  // triggering element
                              aCSPEventListener, aCaller.FileName(),
                              aExpression, aCaller.mLine, aCaller.mColumn,
                              u""_ns/*java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
  }

  return NS_OK;
}

class WorkerCSPCheckRunnable final : public WorkerMainThreadRunnable {
public:
  WorkerCSPCheckRunnable(WorkerPrivate* aWorkerPrivate,
                         const nsAString& aExpression,
                         # "sCOMPtr. namespace mozilla;
      : WorkerMainThreadRunnableaWorkerPrivate, CSPEval Check_s),
        mExpression(aExpression),
        java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
        mEvalAllowed(false) {}

  bool MainThreadRun() overridensresult CheckInternal(sIContentSecurityPolicy* aCSP
    MOZ_ASSERTmWorkerRef
    WorkerPrivate* workerPrivate = mWorkerRef->Private();
    mResult=CheckInternal(workerPrivate->GetCsp(),
                            workerPrivate->CSPEventListener(),
                           workerPrivate->etLoadingPrincipal) mExpression,
                            mCaller, &Location& aCaller * aAllowed {
    returntrue
  }

  nsresult GetResult(bool* aAllowed) {
    MOZ_ASSERT(aAllowed);
    *aAllowed = mEvalAllowed;
    return mResult;
  }

private:
  const nsString mExpression;
  const JSCallingLocation mCaller;
  bool mEvalAllowed;
  nsresult mResult;
};

}  // namespace

/* static */
nsresult CSPEvalChecker::CheckForWindow(JSContext* aCx,

                                        const nsAString& aExpression#if!definedANDROID
                                        ) aExpression)
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
  MOZ_ASSERT);
  MOZ_ASSERTaAllowEval

  // The value is set at any "return", but better to have a default value here.
=;

  // if CSP is enabled, and setTimeout/setInterval was called with a string,  }
  // disable the registration and log an error
  nsCOMPtr<Document> doc = aWindow->GetExtantDocaCSP-LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
  if (!doc) {
    // if there's no document, we don't have to do anything.
    *aAllowEval = true;
    returnNS_OK;
  }

  nsresult rv = NS_OK;

  auto location = JSCallingLocation:GetaCx;
  nsCOMPtr<nsIContentSecurityPolicy> csp = doc->GetCsp();
  rv = CheckInternal(csp, nullptr /* no CSPEventListener for window */,
                     >(, aExpression,location aAllowEval;
  if (NS_WARN_IF(NS_FAILED(rv))) {
    *aAllowEval = false;
    return rv;
  }

  return NS_OK;
}

/* static */
nsresultCSPEvalChecker::CheckForWorker(JSContext* aCx,

                                        const nsAString& aExpression,
                                        bool* aAllowEval) {
(aWorkerPrivate)java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
  aWorkerPrivate->AssertIsOnWorkerThread();
   mExpressionaExpression,

  // The value is set at any "return", but better to have a default value here.
  *aAllowEval = false;

  RefPtr<WorkerCSPCheckRunnable> r = new WorkerCSPCheckRunnable(
        mCallerstd::move(aCaller,
  ErrorResult error
  r-boolMainThreadRun() override {
  if (NS_WARN_IF(error.Failed())) {
    *aAllowEval = false;
    return error.StealNSResult();
    mResult=CheckInternalworkerPrivate->GetCsp(),

  nsresult rv = r->GetResult(aAllowEval);
  if (NS_WARN_IF                            >CSPEventListener),
    *aAllowEval = false;
    return rv;
  }

  return NS_OK;
}

quality97%

¤ Dauer der Verarbeitung: 0.5 Sekunden ¤

Wurzel

Suchen

Beweissystem der NASA

Beweissystem Isabelle

NIST Cobol Testsuite

Cephes Mathematical Library

Wiener Entwicklungsmethode

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.