xpinstall/src/nsInstallTrigger.cpp

   1 /* ***** BEGIN LICENSE BLOCK *****
   2  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   3  *
   4  * The contents of this file are subject to the Mozilla Public License Version
   5  * 1.1 (the "License"); you may not use this file except in compliance with
   6  * the License. You may obtain a copy of the License at
   7  * http://www.mozilla.org/MPL/
   8  *
   9  * Software distributed under the License is distributed on an "AS IS" basis,
  10  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  11  * for the specific language governing rights and limitations under the
  12  * License.
  13  *
  14  * The Original Code is Mozilla Communicator client code, released
  15  * March 31, 1998.
  16  *
  17  * The Initial Developer of the Original Code is
  18  * Netscape Communications Corporation.
  19  * Portions created by the Initial Developer are Copyright (C) 1998
  20  * the Initial Developer. All Rights Reserved.
  21  *
  22  * Contributor(s):
  23  *   Dave Townsend <dtownsend@oxymoronical.com>
  24  *
  25  * Alternatively, the contents of this file may be used under the terms of
  26  * either of the GNU General Public License Version 2 or later (the "GPL"),
  27  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  28  * in which case the provisions of the GPL or the LGPL are applicable instead
  29  * of those above. If you wish to allow use of your version of this file only
  30  * under the terms of either the GPL or the LGPL, and not to allow others to
  31  * use your version of this file under the terms of the MPL, indicate your
  32  * decision by deleting the provisions above and replace them with the notice
  33  * and other provisions required by the GPL or the LGPL. If you do not delete
  34  * the provisions above, a recipient may use your version of this file under
  35  * the terms of any one of the MPL, the GPL or the LGPL.
  36  *
  37  * ***** END LICENSE BLOCK ***** */
  38
  39
  40 #include "nsXPInstallManager.h"
  41 #include "nsInstallTrigger.h"
  42 #include "nsIDOMInstallTriggerGlobal.h"
  43
  44 #include "nscore.h"
  45 #include "nsAutoPtr.h"
  46 #include "netCore.h"
  47 #include "nsIFactory.h"
  48 #include "nsISupports.h"
  49 #include "nsPIDOMWindow.h"
  50 #include "nsIScriptGlobalObject.h"
  51 #include "nsIScriptGlobalObjectOwner.h"
  52
  53 #include "nsIPrefBranch.h"
  54 #include "nsIPrefService.h"
  55 #include "nsIPermissionManager.h"
  56 #include "nsIDocShell.h"
  57 #include "nsNetUtil.h"
  58 #include "nsIDOMDocument.h"
  59 #include "nsIDocument.h"
  60 #include "nsIPrincipal.h"
  61 #include "nsIObserverService.h"
  62 #include "nsIPropertyBag2.h"
  63
  64 #include "nsIComponentManager.h"
  65 #include "nsIServiceManager.h"
  66
  67 #include "nsIContentHandler.h"
  68 #include "nsIChannel.h"
  69 #include "nsIURI.h"
  70 #include "nsXPIInstallInfo.h"
  71
  72
  73 nsInstallTrigger::nsInstallTrigger()
  74 {
  75     mScriptObject   = nsnull;
  76 }
  77
  78 nsInstallTrigger::~nsInstallTrigger()
  79 {
  80 }
  81
  82
  83 NS_IMPL_THREADSAFE_ISUPPORTS3 (nsInstallTrigger,
  84                               nsIScriptObjectOwner,
  85                               nsIDOMInstallTriggerGlobal,
  86                               nsIContentHandler)
  87
  88
  89 NS_IMETHODIMP
  90 nsInstallTrigger::GetScriptObject(nsIScriptContext *aContext, void** aScriptObject)
  91 {
  92     NS_PRECONDITION(nsnull != aScriptObject, "null arg");
  93     nsresult res = NS_OK;
  94
  95     if (nsnull == mScriptObject)
  96     {
  97         res = NS_NewScriptInstallTriggerGlobal(aContext,
  98                                                (nsIDOMInstallTriggerGlobal*)this,
  99                                                aContext->GetGlobalObject(),
 100                                                &mScriptObject);
 101     }
 102
 103     *aScriptObject = mScriptObject;
 104     return res;
 105 }
 106
 107 NS_IMETHODIMP
 108 nsInstallTrigger::SetScriptObject(void *aScriptObject)
 109 {
 110   mScriptObject = aScriptObject;
 111   return NS_OK;
 112 }
 113
 114
 115
 116
 117 NS_IMETHODIMP
 118 nsInstallTrigger::HandleContent(const char * aContentType,
 119                                 nsIInterfaceRequestor* aWindowContext,
 120                                 nsIRequest* aRequest)
 121 {
 122     nsresult rv = NS_OK;
 123     if (!aRequest)
 124         return NS_ERROR_NULL_POINTER;
 125
 126     if (nsCRT::strcasecmp(aContentType, "application/x-xpinstall") != 0)
 127     {
 128         // We only support content-type application/x-xpinstall
 129         return NS_ERROR_WONT_HANDLE_CONTENT;
 130     }
 131
 132     // Save the URI so nsXPInstallManager can re-load it later
 133     nsCOMPtr<nsIURI> uri;
 134     nsCAutoString    urispec;
 135     nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest);
 136     if (channel)
 137     {
 138         rv = channel->GetURI(getter_AddRefs(uri));
 139         if (NS_SUCCEEDED(rv) && uri)
 140             rv = uri->GetSpec(urispec);
 141     }
 142     if (NS_FAILED(rv))
 143         return rv;
 144     if (urispec.IsEmpty())
 145         return NS_ERROR_ILLEGAL_VALUE;
 146
 147
 148     // Save the referrer if any, for permission checks
 149     NS_NAMED_LITERAL_STRING(referrerProperty, "docshell.internalReferrer");
 150     PRBool useReferrer = PR_FALSE;
 151     nsCOMPtr<nsIURI> referringURI;
 152     nsCOMPtr<nsIPropertyBag2> channelprops(do_QueryInterface(channel));
 153
 154     if (channelprops)
 155     {
 156         // Get the referrer from the channel properties if we can (not all
 157         // channels support our internal-referrer property).
 158         //
 159         // It's possible docshell explicitly set a null referrer in the case
 160         // of typed, pasted, or bookmarked URLs and the like. In such a case
 161         // we get a success return value with null pointer.
 162         //
 163         // A null referrer is automatically whitelisted as an explicit user
 164         // action (though they'll still get the confirmation dialog). For a
 165         // missing referrer we go to our fall-back plan of using the XPI
 166         // location for whitelisting purposes.
 167         rv = channelprops->GetPropertyAsInterface(referrerProperty,
 168                                                   NS_GET_IID(nsIURI),
 169                                                   getter_AddRefs(referringURI));
 170         if (NS_SUCCEEDED(rv))
 171             useReferrer = PR_TRUE;
 172     }
 173
 174     // Cancel the current request. nsXPInstallManager restarts the download
 175     // under its control (shared codepath with InstallTrigger)
 176     aRequest->Cancel(NS_BINDING_ABORTED);
 177
 178
 179     // Get the global object of the target window for StartSoftwareUpdate
 180     nsCOMPtr<nsIScriptGlobalObjectOwner> globalObjectOwner =
 181                                          do_QueryInterface(aWindowContext);
 182     nsIScriptGlobalObject* globalObject =
 183       globalObjectOwner ? globalObjectOwner->GetScriptGlobalObject() : nsnull;
 184     if ( !globalObject )
 185         return NS_ERROR_INVALID_ARG;
 186
 187
 188     nsCOMPtr<nsIURI> checkuri;
 189
 190     if ( useReferrer )
 191     {
 192         // easiest and most common case: base decision on the page that
 193         // contained the link
 194         //
 195         // NOTE: the XPI itself may be from elsewhere; the user can decide if
 196         // they trust the actual source when they get the install confirmation
 197         // dialog. The decision we're making here is whether the triggering
 198         // site is one which is allowed to annoy the user with modal dialogs.
 199
 200         checkuri = referringURI;
 201     }
 202     else
 203     {
 204         // Now we're stumbing in the dark. In the most likely case the user
 205         // simply clicked on an FTP link (no referrer) and it's perfectly
 206         // sane to use the current window.
 207         //
 208         // On the other hand the user might be opening a non-http XPI link
 209         // in an unrelated existing window (typed in location bar, bookmark,
 210         // dragged link ...) in which case the current window is irrelevant.
 211         // If we knew it was one of these explicit user actions we'd like to
 212         // allow it, but we have no way of knowing that here.
 213         //
 214         // But there's no way to distinguish the innocent cases from a clever
 215         // malicious site. If we used the target window then evil.com could
 216         // embed a presumed allowed site (e.g. mozilla.org) in a frame, then
 217         // change the location to the XPI and trigger the install. Or evil.com
 218         // could do the same thing in a new window (more work to get around
 219         // popup blocking, but possible).
 220         //
 221         // Our choices appear to be block this type of load entirely or to
 222         // trust only the install URI. The former is unacceptably restrictive,
 223         // the latter allows malicious sites to pester people with modal
 224         // dialogs. As long as the trusted sites don't host bad content that's
 225         // no worse than an endless stream of alert()s -- already possible.
 226         // If the trusted sites don't even have an ftp server then even this
 227         // level of annoyance is not possible.
 228         //
 229         // If a trusted site hosts an install with an exploitable flaw it
 230         // might be possible that a malicious site would attempt to trick
 231         // people into installing it, hoping to turn around and exploit it.
 232         // This is not entirely far-fetched (it's been done with ActiveX
 233         // controls) and will require community policing of the default
 234         // trusted sites.
 235
 236         checkuri = uri;
 237     }
 238
 239     nsAutoPtr<nsXPITriggerInfo> trigger(new nsXPITriggerInfo());
 240     nsAutoPtr<nsXPITriggerItem> item(new nsXPITriggerItem(0, NS_ConvertUTF8toUTF16(urispec).get(),
 241                                                           nsnull));
 242     if (trigger && item)
 243     {
 244         // trigger will own the item now
 245         trigger->Add(item.forget());
 246         nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(globalObject));
 247         nsCOMPtr<nsIXPIInstallInfo> installInfo =
 248                               new nsXPIInstallInfo(win, checkuri, trigger, 0);
 249         if (installInfo)
 250         {
 251             // From here trigger is owned by installInfo until passed on to nsXPInstallManager
 252             trigger.forget();
 253             if (AllowInstall(checkuri))
 254             {
 255                 return StartInstall(installInfo, nsnull);
 256             }
 257             else
 258             {
 259                 nsCOMPtr<nsIObserverService> os(do_GetService("@mozilla.org/observer-service;1"));
 260                 if (os)
 261                     os->NotifyObservers(installInfo,
 262                                         "xpinstall-install-blocked",
 263                                         nsnull);
 264                 return NS_ERROR_ABORT;
 265             }
 266         }
 267     }
 268     return NS_ERROR_OUT_OF_MEMORY;
 269 }
 270
 271
 272 // updateWhitelist
 273 //
 274 // Helper function called by nsInstallTrigger::AllowInstall().
 275 // Interprets the pref as a comma-delimited list of hosts and adds each one
 276 // to the permission manager using the given action. Clear pref when done.
 277 static void updatePermissions( const char* aPref,
 278                                PRUint32 aPermission,
 279                                nsIPermissionManager* aPermissionManager,
 280                                nsIPrefBranch*        aPrefBranch)
 281 {
 282     NS_PRECONDITION(aPref && aPermissionManager && aPrefBranch, "Null arguments!");
 283
 284     nsXPIDLCString hostlist;
 285     nsresult rv = aPrefBranch->GetCharPref( aPref, getter_Copies(hostlist));
 286     if (NS_SUCCEEDED(rv) && !hostlist.IsEmpty())
 287     {
 288         nsCAutoString host;
 289         PRInt32 start=0, match=0;
 290         nsresult rv;
 291         nsCOMPtr<nsIURI> uri;
 292
 293         do {
 294             match = hostlist.FindChar(',', start);
 295
 296             host = Substring(hostlist, start, match-start);
 297             host.CompressWhitespace();
 298             host.Insert("http://", 0);
 299
 300             rv = NS_NewURI(getter_AddRefs(uri), host);
 301             if (NS_SUCCEEDED(rv))
 302             {
 303                 aPermissionManager->Add( uri, XPI_PERMISSION, aPermission );
 304             }
 305             start = match+1;
 306         } while ( match > 0 );
 307
 308         // save empty list, we don't need to do this again
 309         aPrefBranch->SetCharPref( aPref, "");
 310     }
 311 }
 312
 313
 314 // Check whether an Install is allowed. The launching URI can be null,
 315 // in which case only the global pref-setting matters.
 316 PRBool
 317 nsInstallTrigger::AllowInstall(nsIURI* aLaunchURI)
 318 {
 319     // Check the global setting.
 320     PRBool xpiEnabled = PR_FALSE;
 321     nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
 322     if ( !prefBranch)
 323     {
 324         return PR_TRUE; // no pref service in native install, it's OK
 325     }
 326
 327     prefBranch->GetBoolPref( XPINSTALL_ENABLE_PREF, &xpiEnabled);
 328     if ( !xpiEnabled )
 329     {
 330         // globally turned off
 331         return PR_FALSE;
 332     }
 333
 334
 335     // Check permissions for the launching host if we have one
 336     nsCOMPtr<nsIPermissionManager> permissionMgr =
 337                             do_GetService(NS_PERMISSIONMANAGER_CONTRACTID);
 338
 339     if ( permissionMgr && aLaunchURI )
 340     {
 341         PRBool isChrome = PR_FALSE;
 342         PRBool isFile = PR_FALSE;
 343         aLaunchURI->SchemeIs( "chrome", &isChrome );
 344         aLaunchURI->SchemeIs( "file", &isFile );
 345
 346         // file: and chrome: don't need whitelisted hosts
 347         if ( !isChrome && !isFile )
 348         {
 349             // check prefs for permission updates before testing URI
 350             updatePermissions( XPINSTALL_WHITELIST_ADD,
 351                                nsIPermissionManager::ALLOW_ACTION,
 352                                permissionMgr, prefBranch );
 353             updatePermissions( XPINSTALL_WHITELIST_ADD_103,
 354                                nsIPermissionManager::ALLOW_ACTION,
 355                                permissionMgr, prefBranch );
 356             updatePermissions( XPINSTALL_BLACKLIST_ADD,
 357                                nsIPermissionManager::DENY_ACTION,
 358                                permissionMgr, prefBranch );
 359
 360             PRBool requireWhitelist = PR_TRUE;
 361             prefBranch->GetBoolPref( XPINSTALL_WHITELIST_REQUIRED, &requireWhitelist );
 362
 363             PRUint32 permission = nsIPermissionManager::UNKNOWN_ACTION;
 364             permissionMgr->TestPermission( aLaunchURI, XPI_PERMISSION, &permission );
 365
 366             if ( permission == nsIPermissionManager::DENY_ACTION )
 367             {
 368                 xpiEnabled = PR_FALSE;
 369             }
 370             else if ( requireWhitelist &&
 371                       permission != nsIPermissionManager::ALLOW_ACTION )
 372             {
 373                 xpiEnabled = PR_FALSE;
 374             }
 375         }
 376     }
 377
 378     return xpiEnabled;
 379 }
 380
 381
 382 NS_IMETHODIMP
 383 nsInstallTrigger::GetOriginatingURI(nsIScriptGlobalObject* aGlobalObject, nsIURI * *aUri)
 384 {
 385     NS_ENSURE_ARG_POINTER(aGlobalObject);
 386
 387     *aUri = nsnull;
 388
 389     // find the current site
 390     nsCOMPtr<nsIDOMDocument> domdoc;
 391     nsCOMPtr<nsIDOMWindow> window(do_QueryInterface(aGlobalObject));
 392     if ( window )
 393     {
 394         window->GetDocument(getter_AddRefs(domdoc));
 395         nsCOMPtr<nsIDocument> doc(do_QueryInterface(domdoc));
 396         if ( doc )
 397             NS_ADDREF(*aUri = doc->GetDocumentURI());
 398     }
 399     return NS_OK;
 400 }
 401
 402 NS_IMETHODIMP
 403 nsInstallTrigger::UpdateEnabled(nsIScriptGlobalObject* aGlobalObject, PRBool aUseWhitelist, PRBool* aReturn)
 404 {
 405     nsCOMPtr<nsIURI> uri;
 406     nsresult rv = GetOriginatingURI(aGlobalObject, getter_AddRefs(uri));
 407     NS_ENSURE_SUCCESS(rv, rv);
 408     return UpdateEnabled(uri, aUseWhitelist, aReturn);
 409 }
 410
 411 NS_IMETHODIMP
 412 nsInstallTrigger::UpdateEnabled(nsIURI* aURI, PRBool aUseWhitelist, PRBool* aReturn)
 413 {
 414     // disallow unless we successfully find otherwise
 415     *aReturn = PR_FALSE;
 416
 417     if (!aUseWhitelist)
 418     {
 419         // simple global pref check
 420         nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
 421         if (prefBranch)
 422             prefBranch->GetBoolPref( XPINSTALL_ENABLE_PREF, aReturn);
 423     }
 424     else if (aURI)
 425     {
 426         *aReturn = AllowInstall(aURI);
 427     }
 428
 429     return NS_OK;
 430 }
 431
 432
 433 NS_IMETHODIMP
 434 nsInstallTrigger::StartInstall(nsIXPIInstallInfo* aInstallInfo, PRBool* aReturn)
 435 {
 436     if (aReturn)
 437         *aReturn = PR_FALSE;
 438
 439     nsXPInstallManager *mgr = new nsXPInstallManager();
 440     if (mgr)
 441     {
 442         nsresult rv = mgr->InitManagerWithInstallInfo(aInstallInfo);
 443         if (NS_SUCCEEDED(rv) && aReturn)
 444             *aReturn = PR_TRUE;
 445         return rv;
 446     }
 447     else
 448     {
 449         return NS_ERROR_OUT_OF_MEMORY;
 450     }
 451 }