Navigation

Changeset 638

Timestamp:

01/20/08 17:43:05 (10 months ago)

Author:

boo..@youngpup.net

Message:

Apply Anthony's callstack scanning patch to GM_xhr and GM_get/setValue. Other
APIs not done, thinking it might be worth it for compatibility.

Files:

r416	r638
10	10
11	11	GM_ScriptStorage.prototype.setValue = function(name, val) {
	12	if (!GM_apiLeakCheck("GM_setValue")) {
	13	return;
	14	}
	15
12	16	this.prefMan.setValue(name, val);
13	17	}
14	18
15	19	GM_ScriptStorage.prototype.getValue = function(name, defVal) {
	20	if (!GM_apiLeakCheck("GM_getValue")) {
	21	return;
	22	}
	23
16	24	return this.prefMan.getValue(name, defVal);
17	25	}

r398	r638
15	15	// text/xml and we can't support that
16	16	GM_xmlhttpRequester.prototype.contentStartRequest = function(details) {
	17	if (!GM_apiLeakCheck("GM_xmlhttpRequest")) {
	18	return;
	19	}
	20
17	21	// don't actually need the timer functionality, but this pops it
18	22	// out into chromeWindow's thread so that we get that security

r429	r638
8	8	const appSvc = Cc["@mozilla.org/appshell/appShellService;1"]
9	9	.getService(Ci.nsIAppShellService);
	10
	11	const gmSvcFilename = Components.stack.filename;
10	12
11	13	function alert(msg) {
…	…
14	16	.alert(null, "Greasemonkey alert", msg);
15	17	}
	18
	19	// Examines the stack to determine if an API should be callable.
	20	function GM_apiLeakCheck(apiName) {
	21	var stack = Components.stack;
	22
	23	do {
	24	// Valid stack frames for GM api calls are: native and js when coming from
	25	// chrome:// URLs and the greasemonkey.js component's file:// URL.
	26	if (2 == stack.language) {
	27	// NOTE: In FF 2.0.0.0, I saw that stack.filename can be null for JS/XPCOM
	28	// services. This didn't happen in FF 2.0.0.11; I'm not sure when it
	29	// changed.
	30	if (stack.filename != null &&
	31	stack.filename != gmSvcFilename &&
	32	stack.filename.substr(0, 6) != 'chrome') {
	33	GM_logError(new Error("Greasemonkey access violation: unsafeWindow " +
	34	"cannot call " + apiName + "."));
	35	return false;
	36	}
	37	}
	38
	39	stack = stack.caller;
	40	} while (stack);
	41
	42	return true;
	43	};
16	44
17	45	var greasemonkeyService = {