1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/caps/idl/nsIPrincipal.idl Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,259 @@
1.4 +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
1.5 +/* This Source Code Form is subject to the terms of the Mozilla Public
1.6 + * License, v. 2.0. If a copy of the MPL was not distributed with this
1.7 + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1.8 +
1.9 +/* Defines the abstract interface for a principal. */
1.10 +
1.11 +#include "nsISerializable.idl"
1.12 +
1.13 +%{C++
1.14 +struct JSPrincipals;
1.15 +#include "nsCOMPtr.h"
1.16 +#include "nsTArray.h"
1.17 +%}
1.18 +
1.19 +interface nsIURI;
1.20 +interface nsIContentSecurityPolicy;
1.21 +
1.22 +[ptr] native JSContext(JSContext);
1.23 +[ptr] native JSPrincipals(JSPrincipals);
1.24 +[ptr] native PrincipalArray(nsTArray<nsCOMPtr<nsIPrincipal> >);
1.25 +
1.26 +[scriptable, builtinclass, uuid(204555e7-04ad-4cc8-9f0e-840615cc43e8)]
1.27 +interface nsIPrincipal : nsISerializable
1.28 +{
1.29 + /**
1.30 + * Returns whether the other principal is equivalent to this principal.
1.31 + * Principals are considered equal if they are the same principal, or
1.32 + * they have the same origin.
1.33 + */
1.34 + boolean equals(in nsIPrincipal other);
1.35 +
1.36 + /**
1.37 + * Like equals, but takes document.domain changes into account.
1.38 + */
1.39 + boolean equalsConsideringDomain(in nsIPrincipal other);
1.40 +
1.41 + %{C++
1.42 + inline bool Equals(nsIPrincipal* aOther) {
1.43 + bool equal = false;
1.44 + return NS_SUCCEEDED(Equals(aOther, &equal)) && equal;
1.45 + }
1.46 +
1.47 + inline bool EqualsConsideringDomain(nsIPrincipal* aOther) {
1.48 + bool equal = false;
1.49 + return NS_SUCCEEDED(EqualsConsideringDomain(aOther, &equal)) && equal;
1.50 + }
1.51 + %}
1.52 +
1.53 + /**
1.54 + * Returns a hash value for the principal.
1.55 + */
1.56 + [noscript] readonly attribute unsigned long hashValue;
1.57 +
1.58 + /**
1.59 + * The codebase URI to which this principal pertains. This is
1.60 + * generally the document URI.
1.61 + */
1.62 + readonly attribute nsIURI URI;
1.63 +
1.64 + /**
1.65 + * The domain URI to which this principal pertains.
1.66 + * This is congruent with HTMLDocument.domain, and may be null.
1.67 + * Setting this has no effect on the URI.
1.68 + */
1.69 + [noscript] attribute nsIURI domain;
1.70 +
1.71 + /**
1.72 + * The origin of this principal's codebase URI.
1.73 + * An origin is defined as: scheme + host + port.
1.74 + */
1.75 + // XXXcaa this should probably be turned into an nsIURI.
1.76 + // The system principal's origin should be some caps namespace
1.77 + // with a chrome URI. All of chrome should probably be the same.
1.78 + readonly attribute string origin;
1.79 +
1.80 + /**
1.81 + * Returns whether the other principal is equal to or weaker than this
1.82 + * principal. Principals are equal if they are the same object or they
1.83 + * have the same origin.
1.84 + *
1.85 + * Thus a principal always subsumes itself.
1.86 + *
1.87 + * The system principal subsumes itself and all other principals.
1.88 + *
1.89 + * A null principal (corresponding to an unknown, hence assumed minimally
1.90 + * privileged, security context) is not equal to any other principal
1.91 + * (including other null principals), and therefore does not subsume
1.92 + * anything but itself.
1.93 + */
1.94 + boolean subsumes(in nsIPrincipal other);
1.95 +
1.96 + /**
1.97 + * Same as the previous method, subsumes(), but takes document.domain into
1.98 + * account.
1.99 + */
1.100 + boolean subsumesConsideringDomain(in nsIPrincipal other);
1.101 +
1.102 + %{C++
1.103 + inline bool Subsumes(nsIPrincipal* aOther) {
1.104 + bool subsumes = false;
1.105 + return NS_SUCCEEDED(Subsumes(aOther, &subsumes)) && subsumes;
1.106 + }
1.107 +
1.108 + inline bool SubsumesConsideringDomain(nsIPrincipal* aOther) {
1.109 + bool subsumes = false;
1.110 + return NS_SUCCEEDED(SubsumesConsideringDomain(aOther, &subsumes)) && subsumes;
1.111 + }
1.112 + %}
1.113 +
1.114 + /**
1.115 + * Checks whether this principal is allowed to load the network resource
1.116 + * located at the given URI under the same-origin policy. This means that
1.117 + * codebase principals are only allowed to load resources from the same
1.118 + * domain, the system principal is allowed to load anything, and null
1.119 + * principals are not allowed to load anything. This is changed slightly
1.120 + * by the optional flag allowIfInheritsPrincipal (which defaults to false)
1.121 + * which allows the load of a data: URI (which inherits the principal of
1.122 + * its loader) or a URI with the same principal as its loader (eg. a
1.123 + * Blob URI).
1.124 + * In these cases, with allowIfInheritsPrincipal set to true, the URI can
1.125 + * be loaded by a null principal.
1.126 + *
1.127 + * If the load is allowed this function does nothing. If the load is not
1.128 + * allowed the function throws NS_ERROR_DOM_BAD_URI.
1.129 + *
1.130 + * NOTE: Other policies might override this, such as the Access-Control
1.131 + * specification.
1.132 + * NOTE: The 'domain' attribute has no effect on the behaviour of this
1.133 + * function.
1.134 + *
1.135 + *
1.136 + * @param uri The URI about to be loaded.
1.137 + * @param report If true, will report a warning to the console service
1.138 + * if the load is not allowed.
1.139 + * @param allowIfInheritsPrincipal If true, the load is allowed if the
1.140 + * loadee inherits the principal of the
1.141 + * loader.
1.142 + * @throws NS_ERROR_DOM_BAD_URI if the load is not allowed.
1.143 + */
1.144 + void checkMayLoad(in nsIURI uri, in boolean report,
1.145 + in boolean allowIfInheritsPrincipal);
1.146 +
1.147 + /**
1.148 + * A Content Security Policy associated with this principal.
1.149 + */
1.150 + [noscript] attribute nsIContentSecurityPolicy csp;
1.151 +
1.152 + /**
1.153 + * Returns the jar prefix of the principal.
1.154 + * The jar prefix is a string that can be used to isolate data or
1.155 + * permissions between different principals while taking into account
1.156 + * parameters like the app id or the fact that the principal is embedded in
1.157 + * a mozbrowser.
1.158 + * Some principals will return an empty string.
1.159 + * Some principals will assert if you try to access the jarPrefix.
1.160 + *
1.161 + * The jarPrefix is intended to be an opaque identifier. It is currently
1.162 + * "human-readable" but no callers should assume it will stay as is and
1.163 + * it might be crypto-hashed at some point.
1.164 + */
1.165 + readonly attribute AUTF8String jarPrefix;
1.166 +
1.167 + /**
1.168 + * The base domain of the codebase URI to which this principal pertains
1.169 + * (generally the document URI), handling null principals and
1.170 + * non-hierarchical schemes correctly.
1.171 + */
1.172 + readonly attribute ACString baseDomain;
1.173 +
1.174 + const short APP_STATUS_NOT_INSTALLED = 0;
1.175 + const short APP_STATUS_INSTALLED = 1;
1.176 + const short APP_STATUS_PRIVILEGED = 2;
1.177 + const short APP_STATUS_CERTIFIED = 3;
1.178 +
1.179 + /**
1.180 + * Gets the principal's app status, which indicates whether the principal
1.181 + * corresponds to "app code", and if it does, how privileged that code is.
1.182 + * This method returns one of the APP_STATUS constants above.
1.183 + *
1.184 + * Note that a principal may have
1.185 + *
1.186 + * appId != nsIScriptSecurityManager::NO_APP_ID &&
1.187 + * appId != nsIScriptSecurityManager::UNKNOWN_APP_ID
1.188 + *
1.189 + * and still have appStatus == APP_STATUS_NOT_INSTALLED. That's because
1.190 + * appId identifies the app that contains this principal, but a window
1.191 + * might be contained in an app and not be running code that the app has
1.192 + * vouched for. For example, the window might be inside an <iframe
1.193 + * mozbrowser>, or the window's origin might not match the app's origin.
1.194 + *
1.195 + * If you're doing a check to determine "does this principal correspond to
1.196 + * app code?", you must check appStatus; checking appId != NO_APP_ID is not
1.197 + * sufficient.
1.198 + */
1.199 + [infallible] readonly attribute unsigned short appStatus;
1.200 +
1.201 + /**
1.202 + * Gets the id of the app this principal is inside. If this principal is
1.203 + * not inside an app, returns nsIScriptSecurityManager::NO_APP_ID.
1.204 + *
1.205 + * Note that this principal does not necessarily have the permissions of
1.206 + * the app identified by appId. For example, this principal might
1.207 + * correspond to an iframe whose origin differs from that of the app frame
1.208 + * containing it. In this case, the iframe will have the appId of its
1.209 + * containing app frame, but the iframe must not run with the app's
1.210 + * permissions.
1.211 + *
1.212 + * Similarly, this principal might correspond to an <iframe mozbrowser>
1.213 + * inside an app frame; in this case, the content inside the iframe should
1.214 + * not have any of the app's permissions, even if the iframe is at the same
1.215 + * origin as the app.
1.216 + *
1.217 + * If you're doing a security check based on appId, you must check
1.218 + * appStatus as well.
1.219 + */
1.220 + [infallible] readonly attribute unsigned long appId;
1.221 +
1.222 + /**
1.223 + * Returns true iff the principal is inside a browser element. (<iframe
1.224 + * mozbrowser mozapp> does not count as a browser element.)
1.225 + */
1.226 + [infallible] readonly attribute boolean isInBrowserElement;
1.227 +
1.228 + /**
1.229 + * Returns true if this principal has an unknown appId. This shouldn't
1.230 + * generally be used. We only expose it due to not providing the correct
1.231 + * appId everywhere where we construct principals.
1.232 + */
1.233 + [infallible] readonly attribute boolean unknownAppId;
1.234 +
1.235 + /**
1.236 + * Returns true iff this principal is a null principal (corresponding to an
1.237 + * unknown, hence assumed minimally privileged, security context).
1.238 + */
1.239 + [infallible] readonly attribute boolean isNullPrincipal;
1.240 +};
1.241 +
1.242 +/**
1.243 + * If nsSystemPrincipal is too risky to use, but we want a principal to access
1.244 + * more than one origin, nsExpandedPrincipals letting us define an array of
1.245 + * principals it subsumes. So script with an nsExpandedPrincipals will gain
1.246 + * same origin access when at least one of its principals it contains gained
1.247 + * sameorigin acccess. An nsExpandedPrincipal will be subsumed by the system
1.248 + * principal, and by another nsExpandedPrincipal that has all its principals.
1.249 + * It is added for jetpack content-scripts to let them interact with the
1.250 + * content and a well defined set of other domains, without the risk of
1.251 + * leaking out a system principal to the content. See: Bug 734891
1.252 + */
1.253 +[uuid(f3e177Df-6a5e-489f-80a7-2dd1481471d8)]
1.254 +interface nsIExpandedPrincipal : nsISupports
1.255 +{
1.256 + /**
1.257 + * An array of principals that the expanded principal subsumes.
1.258 + * Note: this list is not reference counted, it is shared, so
1.259 + * should not be changed and should only be used ephemerally.
1.260 + */
1.261 + [noscript] readonly attribute PrincipalArray whiteList;
1.262 +};
