Security:Security Checks In Glue: Difference between revisions

Security:Security Checks In Glue (view source)

24 bytes added , 12 September 2006

308

edits

@@ Line 7: / Line 7: @@
 In this model, security checks are performed only at known entry points from JavaScript into C++.  For example, consider the following JavaScript:
-   document.importNode(node);
+   window.status = "Status";
-This code needs to perform a security check to see whether <code>document</code> and <code>node</code> are same-origin.  In this model, this check could be performed in the following places:
+This code needs to perform a security check to see whether the caller is allowed to change the text in the status bar.  In this model, this check could be performed in the following places:
-# The code mapping Document.importNode to nsDocument::ImportNode
+# The code mapping Window.status to nsGlobalWindow::SetStatus.
-# The implementation of nsDocument::ImportNode
+# The implementation of nsGlobalWindow::SetStatus.
-The check could NOT be performed in nsNodeUtils::Clone, which is called by nsDocument::ImportNode to do the actual work of importing in this case.
+The check could NOT be performed in nsIWebBrowserChrome::SetStatus, which is called by nsGlobalWindow::SetStatus to do the actual work of setting the status in this case.
 In general, in this model there is a concept of "the function currently being called from JS".  This function is the only function that does security checks.