caps/idl/nsIScriptSecurityManager.idl

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* ***** BEGIN LICENSE BLOCK *****
   3  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   4  *
   5  * The contents of this file are subject to the Mozilla Public License Version
   6  * 1.1 (the "License"); you may not use this file except in compliance with
   7  * the License. You may obtain a copy of the License at
   8  * http://www.mozilla.org/MPL/
   9  *
  10  * Software distributed under the License is distributed on an "AS IS" basis,
  11  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  12  * for the specific language governing rights and limitations under the
  13  * License.
  14  *
  15  * The Original Code is mozilla.org code.
  16  *
  17  * The Initial Developer of the Original Code is
  18  * Netscape Communications Corporation.
  19  * Portions created by the Initial Developer are Copyright (C) 1999
  20  * the Initial Developer. All Rights Reserved.
  21  *
  22  * Contributor(s):
  23  *
  24  * Alternatively, the contents of this file may be used under the terms of
  25  * either of the GNU General Public License Version 2 or later (the "GPL"),
  26  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  27  * in which case the provisions of the GPL or the LGPL are applicable instead
  28  * of those above. If you wish to allow use of your version of this file only
  29  * under the terms of either the GPL or the LGPL, and not to allow others to
  30  * use your version of this file under the terms of the MPL, indicate your
  31  * decision by deleting the provisions above and replace them with the notice
  32  * and other provisions required by the GPL or the LGPL. If you do not delete
  33  * the provisions above, a recipient may use your version of this file under
  34  * the terms of any one of the MPL, the GPL or the LGPL.
  35  *
  36  * ***** END LICENSE BLOCK ***** */
  37
  38 #include "nsISupports.idl"
  39 #include "nsIPrincipal.idl"
  40 #include "nsIXPCSecurityManager.idl"
  41 interface nsIURI;
  42 interface nsIChannel;
  43
  44 /**
  45  * WARNING!! The JEP needs to call GetSubjectPrincipal()
  46  * to support JavaScript-to-Java LiveConnect.  So every change to the
  47  * nsIScriptSecurityManager interface (big enough to change its IID) also
  48  * breaks JavaScript-to-Java LiveConnect on mac.
  49  *
  50  * If you REALLY have to change this interface, please mark your bug as
  51  * blocking bug 293973.
  52  */
  53 [scriptable, uuid(f8e350b9-9f31-451a-8c8f-d10fea26b780)]
  54 interface nsIScriptSecurityManager : nsIXPCSecurityManager
  55 {
  56     ///////////////// Security Checks //////////////////
  57     /**
  58      * Checks whether the running script is allowed to access aProperty.
  59      */
  60     [noscript] void checkPropertyAccess(in JSContextPtr aJSContext,
  61                                         in JSObjectPtr aJSObject,
  62                                         in string aClassName,
  63                                         in JSVal aProperty,
  64                                         in PRUint32 aAction);
  65
  66     /**
  67      * Checks whether the running script is allowed to connect to aTargetURI
  68      */
  69     [noscript] void checkConnect(in JSContextPtr aJSContext,
  70                                  in nsIURI aTargetURI,
  71                                  in string aClassName,
  72                                  in string aProperty);
  73
  74     /**
  75      * Check that the script currently running in context "cx" can load "uri".
  76      *
  77      * Will return error code NS_ERROR_DOM_BAD_URI if the load request
  78      * should be denied.
  79      *
  80      * @param cx the JSContext of the script causing the load
  81      * @param uri the URI that is being loaded
  82      */
  83     [noscript] void checkLoadURIFromScript(in JSContextPtr cx, in nsIURI uri);
  84
  85     /**
  86      * Default CheckLoadURI permissions
  87      */
  88     // Default permissions
  89     const unsigned long STANDARD = 0;
  90
  91     // Indicate that the load is a load of a new document that is not
  92     // user-triggered.  Here "user-triggered" could be broadly interpreted --
  93     // for example, scripted sets of window.location.href might be treated as
  94     // "user-triggered" in some circumstances.  A typical example of a load
  95     // that is not user-triggered is a <meta> refresh load.  If this flag is
  96     // set, the load will be denied if the originating principal's URI has the
  97     // nsIProtocolHandler::URI_FORBIDS_AUTOMATIC_DOCUMENT_REPLACEMENT flag set.
  98     const unsigned long LOAD_IS_AUTOMATIC_DOCUMENT_REPLACEMENT = 1 << 0;
  99
 100     // Allow the loading of chrome URLs by non-chrome URLs.  Use with great
 101     // care!  This will actually allow the loading of any URI which has the
 102     // nsIProtocolHandler::URI_IS_UI_RESOURCE protocol handler flag set.  Ths
 103     // probably means at least chrome: and resource:.
 104     const unsigned long ALLOW_CHROME = 1 << 1;
 105
 106     // Don't allow URLs which would inherit the caller's principal (such as
 107     // javascript: or data:) to load.  See
 108     // nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT.
 109     const unsigned long DISALLOW_INHERIT_PRINCIPAL = 1 << 2;
 110
 111     // Alias for DISALLOW_INHERIT_PRINCIPAL for backwards compat with
 112     // JS-implemented extensions.
 113     const unsigned long DISALLOW_SCRIPT_OR_DATA = DISALLOW_INHERIT_PRINCIPAL;
 114
 115     // Don't allow javascript: URLs to load
 116     //   WARNING: Support for this value was added in Mozilla 1.7.8 and
 117     //   Firefox 1.0.4.  Use in prior versions WILL BE IGNORED.
 118     // When using this, make sure that you actually want DISALLOW_SCRIPT, not
 119     // DISALLOW_INHERIT_PRINCIPAL
 120     const unsigned long DISALLOW_SCRIPT = 1 << 3;
 121
 122     /**
 123      * Check that content with principal aPrincipal can load "uri".
 124      *
 125      * Will return error code NS_ERROR_DOM_BAD_URI if the load request
 126      * should be denied.
 127      *
 128      * @param aPrincipal the principal identifying the actor causing the load
 129      * @param uri the URI that is being loaded
 130      * @param flags the permission set, see above
 131      */
 132     void checkLoadURIWithPrincipal(in nsIPrincipal aPrincipal,
 133                                    in nsIURI uri,
 134                                    in unsigned long flags);
 135
 136     /**
 137      * Check that content from "from" can load "uri".
 138      *
 139      * Will return error code NS_ERROR_DOM_BAD_URI if the load request
 140      * should be denied.
 141      *
 142      * @param from the URI causing the load
 143      * @param uri the URI that is being loaded
 144      * @param flags the permission set, see above
 145      *
 146      * @deprecated Use checkLoadURIWithPrincipal instead of this function.
 147      */
 148     void checkLoadURI(in nsIURI from, in nsIURI uri,
 149                       in unsigned long flags);
 150
 151     /**
 152      * Similar to checkLoadURIWithPrincipal but there are two differences:
 153      *
 154      * 1) The URI is a string, not a URI object.
 155      * 2) This function assumes that the URI may still be subject to fixup (and
 156      * hence will check whether fixed-up versions of the URI are allowed to
 157      * load as well); if any of the versions of this URI is not allowed, this
 158      * function will return error code NS_ERROR_DOM_BAD_URI.
 159      */
 160     void checkLoadURIStrWithPrincipal(in nsIPrincipal aPrincipal,
 161                                       in AUTF8String uri,
 162                                       in unsigned long flags);
 163
 164     /**
 165      * Same as CheckLoadURI but takes string arguments for ease of use
 166      * by scripts
 167      *
 168      * @deprecated Use checkLoadURIStrWithPrincipal instead of this function.
 169      */
 170     void checkLoadURIStr(in AUTF8String from, in AUTF8String uri,
 171                          in unsigned long flags);
 172
 173     /**
 174      * Check that the function 'funObj' is allowed to run on 'targetObj'
 175      *
 176      * Will return error code NS_ERROR_DOM_SECURITY_ERR if the function
 177      * should not run
 178      *
 179      * @param cx The current active JavaScript context.
 180      * @param funObj The function trying to run..
 181      * @param targetObj The object the function will run on.
 182      */
 183     [noscript] void checkFunctionAccess(in JSContextPtr cx, in voidPtr funObj,
 184                                         in voidPtr targetObj);
 185
 186     /**
 187      * Return true if content from the given principal is allowed to
 188      * execute scripts.
 189      */
 190     [noscript] boolean canExecuteScripts(in JSContextPtr cx,
 191                                          in nsIPrincipal principal);
 192
 193     ///////////////// Principals ///////////////////////
 194     /**
 195      * Return the principal of the innermost frame of the currently
 196      * executing script. Will return null if there is no script
 197      * currently executing.
 198      */
 199     [noscript] nsIPrincipal getSubjectPrincipal();
 200
 201     /**
 202      * Return the all-powerful system principal.
 203      */
 204     [noscript] nsIPrincipal getSystemPrincipal();
 205
 206     /**
 207      * Return a principal with the specified certificate fingerprint, subject
 208      * name (the full name or concatenated set of names of the entity
 209      * represented by the certificate), pretty name, certificate, and
 210      * codebase URI.  The certificate fingerprint and subject name MUST be
 211      * nonempty; otherwise an error will be thrown.  Similarly, aCert must
 212      * not be null.
 213      */
 214     [noscript] nsIPrincipal
 215          getCertificatePrincipal(in AUTF8String aCertFingerprint,
 216                                  in AUTF8String aSubjectName,
 217                                  in AUTF8String aPrettyName,
 218                                  in nsISupports aCert,
 219                                  in nsIURI aURI);
 220
 221     /**
 222      * Return a principal that has the same origin as aURI.
 223      */
 224     nsIPrincipal getCodebasePrincipal(in nsIURI aURI);
 225
 226     ///////////////// Capabilities API /////////////////////
 227     /**
 228      * Request that 'capability' can be enabled by scripts or applets
 229      * running with 'principal'. Will prompt user if
 230      * necessary. Returns nsIPrincipal::ENABLE_GRANTED or
 231      * nsIPrincipal::ENABLE_DENIED based on user's choice.
 232      */
 233     [noscript] short requestCapability(in nsIPrincipal principal,
 234                                        in string capability);
 235
 236     /**
 237      * Return true if the currently executing script has 'capability' enabled.
 238      */
 239     boolean isCapabilityEnabled(in string capability);
 240
 241     /**
 242      * Enable 'capability' in the innermost frame of the currently executing
 243      * script.
 244      */
 245     void enableCapability(in string capability);
 246
 247     /**
 248      * Remove 'capability' from the innermost frame of the currently
 249      * executing script. Any setting of 'capability' from enclosing
 250      * frames thus comes into effect.
 251      */
 252     void revertCapability(in string capability);
 253
 254     /**
 255      * Disable 'capability' in the innermost frame of the currently executing
 256      * script.
 257      */
 258     void disableCapability(in string capability);
 259
 260     //////////////// Master Certificate Functions ////////////////////
 261     /**
 262      * Allow 'certificateID' to enable 'capability.' Can only be performed
 263      * by code signed by the system certificate.
 264      */
 265     // XXXbz Capabilities can't have non-ascii chars?
 266     // XXXbz ideally we'd pass a subjectName here too, and the nsISupports
 267     // cert we're enabling for...
 268     void setCanEnableCapability(in AUTF8String certificateFingerprint,
 269                                 in string capability,
 270                                 in short canEnable);
 271
 272     ///////////////////////
 273     /**
 274      * Return the principal of the specified object in the specified context.
 275      */
 276     [noscript] nsIPrincipal getObjectPrincipal(in JSContextPtr cx,
 277                                                in JSObjectPtr obj);
 278
 279     /**
 280      * Returns true if the principal of the currently running script is the
 281      * system principal, false otherwise.
 282      */
 283     [noscript] boolean subjectPrincipalIsSystem();
 284
 285     /**
 286      * Returns OK if aJSContext and target have the same "origin"
 287      * (scheme, host, and port).
 288      */
 289     [noscript] void checkSameOrigin(in JSContextPtr aJSContext,
 290                                     in nsIURI aTargetURI);
 291
 292     /**
 293      * Returns OK if aSourceURI and target have the same "origin"
 294      * (scheme, host, and port).
 295      * ReportError flag suppresses error reports for functions that
 296      * don't need reporting.
 297      */
 298     void checkSameOriginURI(in nsIURI aSourceURI,
 299                             in nsIURI aTargetURI,
 300                             in boolean reportError);
 301
 302     /**
 303      * Returns the principal of the global object of the given context, or null
 304      * if no global or no principal.
 305      */
 306     [noscript] nsIPrincipal getPrincipalFromContext(in JSContextPtr cx);
 307
 308     /**
 309      * Get the principal for the given channel.  This will typically be the
 310      * channel owner if there is one, and the codebase principal for the
 311      * channel's URI otherwise.  aChannel must not be null.
 312      */
 313     nsIPrincipal getChannelPrincipal(in nsIChannel aChannel);
 314
 315     /**
 316      * Check whether a given principal is a system principal.  This allows us
 317      * to avoid handing back the system principal to script while allowing
 318      * script to check whether a given principal is system.
 319      */
 320     boolean isSystemPrincipal(in nsIPrincipal aPrincipal);
 321
 322     /**
 323      * Same as getSubjectPrincipal(), only faster. cx must *never* be
 324      * passed null, and it must be the context on the top of the
 325      * context stack. Does *not* reference count the returned
 326      * principal.
 327      */
 328     [noscript,notxpcom] nsIPrincipal getCxSubjectPrincipal(in JSContextPtr cx);
 329     [noscript,notxpcom] nsIPrincipal getCxSubjectPrincipalAndFrame(in JSContextPtr cx,
 330                                                                    out JSStackFramePtr fp);
 331 };
 332
 333 %{C++
 334 #define NS_SCRIPTSECURITYMANAGER_CONTRACTID "@mozilla.org/scriptsecuritymanager;1"
 335 #define NS_SCRIPTSECURITYMANAGER_CLASSNAME "scriptsecuritymanager"
 336 %}