The Tor Browser: comparison caps/idl/nsIPrincipal.idl

--1:000000000000
+:022111b1e034
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+* License, v. 2.0. If a copy of the MPL was not distributed with this
+* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* Defines the abstract interface for a principal. */
+#include "nsISerializable.idl"
+%{C++
+struct JSPrincipals;
+#include "nsCOMPtr.h"
+#include "nsTArray.h"
+%}
+interface nsIURI;
+interface nsIContentSecurityPolicy;
+[ptr] native JSContext(JSContext);
+[ptr] native JSPrincipals(JSPrincipals);
+[ptr] native PrincipalArray(nsTArray<nsCOMPtr<nsIPrincipal> >);
+[scriptable, builtinclass, uuid(204555e7-04ad-4cc8-9f0e-840615cc43e8)]
+interface nsIPrincipal : nsISerializable
+{
+/**
+* Returns whether the other principal is equivalent to this principal.
+* Principals are considered equal if they are the same principal, or
+* they have the same origin.
+*/
+boolean equals(in nsIPrincipal other);
+/**
+* Like equals, but takes document.domain changes into account.
+*/
+boolean equalsConsideringDomain(in nsIPrincipal other);
+%{C++
+inline bool Equals(nsIPrincipal* aOther) {
+bool equal = false;
+return NS_SUCCEEDED(Equals(aOther, &equal)) && equal;
+}
+inline bool EqualsConsideringDomain(nsIPrincipal* aOther) {
+bool equal = false;
+return NS_SUCCEEDED(EqualsConsideringDomain(aOther, &equal)) && equal;
+}
+%}
+/**
+* Returns a hash value for the principal.
+*/
+[noscript] readonly attribute unsigned long hashValue;
+/**
+* The codebase URI to which this principal pertains.  This is
+* generally the document URI.
+*/
+readonly attribute nsIURI URI;
+/**
+* The domain URI to which this principal pertains.
+* This is congruent with HTMLDocument.domain, and may be null.
+* Setting this has no effect on the URI.
+*/
+[noscript] attribute nsIURI domain;
+/**
+* The origin of this principal's codebase URI.
+* An origin is defined as: scheme + host + port.
+*/
+// XXXcaa this should probably be turned into an nsIURI.
+// The system principal's origin should be some caps namespace
+// with a chrome URI.  All of chrome should probably be the same.
+readonly attribute string origin;
+/**
+* Returns whether the other principal is equal to or weaker than this
+* principal. Principals are equal if they are the same object or they
+* have the same origin.
+*
+* Thus a principal always subsumes itself.
+*
+* The system principal subsumes itself and all other principals.
+*
+* A null principal (corresponding to an unknown, hence assumed minimally
+* privileged, security context) is not equal to any other principal
+* (including other null principals), and therefore does not subsume
+* anything but itself.
+*/
+boolean subsumes(in nsIPrincipal other);
+/**
+* Same as the previous method, subsumes(), but takes document.domain into
+* account.
+*/
+boolean subsumesConsideringDomain(in nsIPrincipal other);
+%{C++
+inline bool Subsumes(nsIPrincipal* aOther) {
+bool subsumes = false;
+return NS_SUCCEEDED(Subsumes(aOther, &subsumes)) && subsumes;
+}
+inline bool SubsumesConsideringDomain(nsIPrincipal* aOther) {
+bool subsumes = false;
+return NS_SUCCEEDED(SubsumesConsideringDomain(aOther, &subsumes)) && subsumes;
+}
+%}
+/**
+* Checks whether this principal is allowed to load the network resource
+* located at the given URI under the same-origin policy. This means that
+* codebase principals are only allowed to load resources from the same
+* domain, the system principal is allowed to load anything, and null
+* principals are not allowed to load anything. This is changed slightly
+* by the optional flag allowIfInheritsPrincipal (which defaults to false)
+* which allows the load of a data: URI (which inherits the principal of
+* its loader) or a URI with the same principal as its loader (eg. a
+* Blob URI).
+* In these cases, with allowIfInheritsPrincipal set to true, the URI can
+* be loaded by a null principal.
+*
+* If the load is allowed this function does nothing. If the load is not
+* allowed the function throws NS_ERROR_DOM_BAD_URI.
+*
+* NOTE: Other policies might override this, such as the Access-Control
+*       specification.
+* NOTE: The 'domain' attribute has no effect on the behaviour of this
+*       function.
+*
+*
+* @param uri    The URI about to be loaded.
+* @param report If true, will report a warning to the console service
+*               if the load is not allowed.
+* @param allowIfInheritsPrincipal   If true, the load is allowed if the
+*                                   loadee inherits the principal of the
+*                                   loader.
+* @throws NS_ERROR_DOM_BAD_URI if the load is not allowed.
+*/
+void checkMayLoad(in nsIURI uri, in boolean report,
+in boolean allowIfInheritsPrincipal);
+/**
+* A Content Security Policy associated with this principal.
+*/
+[noscript] attribute nsIContentSecurityPolicy csp;
+/**
+* Returns the jar prefix of the principal.
+* The jar prefix is a string that can be used to isolate data or
+* permissions between different principals while taking into account
+* parameters like the app id or the fact that the principal is embedded in
+* a mozbrowser.
+* Some principals will return an empty string.
+* Some principals will assert if you try to access the jarPrefix.
+*
+* The jarPrefix is intended to be an opaque identifier. It is currently
+* "human-readable" but no callers should assume it will stay as is and
+* it might be crypto-hashed at some point.
+*/
+readonly attribute AUTF8String jarPrefix;
+/**
+* The base domain of the codebase URI to which this principal pertains
+* (generally the document URI), handling null principals and
+* non-hierarchical schemes correctly.
+*/
+readonly attribute ACString baseDomain;
+const short APP_STATUS_NOT_INSTALLED = 0;
+const short APP_STATUS_INSTALLED     = 1;
+const short APP_STATUS_PRIVILEGED    = 2;
+const short APP_STATUS_CERTIFIED     = 3;
+/**
+* Gets the principal's app status, which indicates whether the principal
+* corresponds to "app code", and if it does, how privileged that code is.
+* This method returns one of the APP_STATUS constants above.
+*
+* Note that a principal may have
+*
+*   appId != nsIScriptSecurityManager::NO_APP_ID &&
+*   appId != nsIScriptSecurityManager::UNKNOWN_APP_ID
+*
+* and still have appStatus == APP_STATUS_NOT_INSTALLED.  That's because
+* appId identifies the app that contains this principal, but a window
+* might be contained in an app and not be running code that the app has
+* vouched for.  For example, the window might be inside an <iframe
+* mozbrowser>, or the window's origin might not match the app's origin.
+*
+* If you're doing a check to determine "does this principal correspond to
+* app code?", you must check appStatus; checking appId != NO_APP_ID is not
+* sufficient.
+*/
+[infallible] readonly attribute unsigned short appStatus;
+/**
+* Gets the id of the app this principal is inside.  If this principal is
+* not inside an app, returns nsIScriptSecurityManager::NO_APP_ID.
+*
+* Note that this principal does not necessarily have the permissions of
+* the app identified by appId.  For example, this principal might
+* correspond to an iframe whose origin differs from that of the app frame
+* containing it.  In this case, the iframe will have the appId of its
+* containing app frame, but the iframe must not run with the app's
+* permissions.
+*
+* Similarly, this principal might correspond to an <iframe mozbrowser>
+* inside an app frame; in this case, the content inside the iframe should
+* not have any of the app's permissions, even if the iframe is at the same
+* origin as the app.
+*
+* If you're doing a security check based on appId, you must check
+* appStatus as well.
+*/
+[infallible] readonly attribute unsigned long appId;
+/**
+* Returns true iff the principal is inside a browser element.  (<iframe
+* mozbrowser mozapp> does not count as a browser element.)
+*/
+[infallible] readonly attribute boolean isInBrowserElement;
+/**
+* Returns true if this principal has an unknown appId. This shouldn't
+* generally be used. We only expose it due to not providing the correct
+* appId everywhere where we construct principals.
+*/
+[infallible] readonly attribute boolean unknownAppId;
+/**
+* Returns true iff this principal is a null principal (corresponding to an
+* unknown, hence assumed minimally privileged, security context).
+*/
+[infallible] readonly attribute boolean isNullPrincipal;
+};
+/**
+* If nsSystemPrincipal is too risky to use, but we want a principal to access
+* more than one origin, nsExpandedPrincipals letting us define an array of
+* principals it subsumes. So script with an nsExpandedPrincipals will gain
+* same origin access when at least one of its principals it contains gained
+* sameorigin acccess. An nsExpandedPrincipal will be subsumed by the system
+* principal, and by another nsExpandedPrincipal that has all its principals.
+* It is added for jetpack content-scripts to let them interact with the
+* content and a well defined set of other domains, without the risk of
+* leaking out a system principal to the content. See: Bug 734891
+*/
+[uuid(f3e177Df-6a5e-489f-80a7-2dd1481471d8)]
+interface nsIExpandedPrincipal : nsISupports
+{
+/**
+* An array of principals that the expanded principal subsumes.
+* Note: this list is not reference counted, it is shared, so
+* should not be changed and should only be used ephemerally.
+*/
+[noscript] readonly attribute PrincipalArray whiteList;
+};

The Tor Browser / file comparison

comparison: caps/idl/nsIPrincipal.idl

caps/idl/nsIPrincipal.idl