XPConnect Chrome Object Wrappers

Introduction

Chrome Object Wrappers, or COWs for short, allow privileged code to securely expose some subset of its functionality to untrusted or semi-trusted content.

Usage

COWs are always created automatically whenever an object passes through a trust boundary. For instance, assume the following chrome-privileged code:

var sandbox = Components.utils.Sandbox("http://www.mozilla.org");
sandbox.foo = function foo(x) { /* ... */ };
var result = Components.utils.evalInSandbox("foo({bar: 5});");

In the above example, foo() is wrapped by a COW when accessed by sandboxed code executed via Components.utils.evalInSandbox().