/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

/* vim: set ts=8 sts=2 et sw=2 tw=80: */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "WindowNamedPropertiesHandler.h"

#include "mozilla/dom/EventTargetBinding.h"

#include "mozilla/dom/WindowBinding.h"

#include "nsContentUtils.h"

#include "nsDOMWindowList.h"

#include "nsGlobalWindow.h"

#include "nsHTMLDocument.h"

#include "nsJSUtils.h"

#include "xpcprivate.h"

namespace mozilla {

namespace dom {

static bool

ShouldExposeChildWindow(nsString& aNameBeingResolved, nsPIDOMWindowOuter* aChild)

{

  Element* e = aChild->GetFrameElementInternal();

  if (e && e->IsInShadowTree()) {

    return false;

  }

  // If we're same-origin with the child, go ahead and expose it.

  nsCOMPtr<nsIScriptObjectPrincipal> sop = do_QueryInterface(aChild);

  NS_ENSURE_TRUE(sop, false);

  if (nsContentUtils::SubjectPrincipal()->Equals(sop->GetPrincipal())) {

    return true;

  }

  // If we're not same-origin, expose it _only_ if the name of the browsing

  // context matches the 'name' attribute of the frame element in the parent.

  // The motivations behind this heuristic are worth explaining here.

  //

  // Historically, all UAs supported global named access to any child browsing

  // context (that is to say, window.dolske returns a child frame where either

  // the "name" attribute on the frame element was set to "dolske", or where

  // the child explicitly set window.name = "dolske").

  //

  // This is problematic because it allows possibly-malicious and unrelated

  // cross-origin subframes to pollute the global namespace of their parent in

  // unpredictable ways (see bug 860494). This is also problematic for browser

  // engines like Servo that want to run cross-origin script on different

  // threads.

  //

  // The naive solution here would be to filter out any cross-origin subframes

  // obtained when doing named lookup in global scope. But that is unlikely to

  // be web-compatible, since it will break named access for consumers that do

  // <iframe name="dolske" src="http://cross-origin.com/sadtrombone.html"> and

  // expect to be able to access the cross-origin subframe via named lookup on

  // the global.

  //

  // The optimal behavior would be to do the following:

  // (a) Look for any child browsing context with name="dolske".

  // (b) If the result is cross-origin, null it out.

  // (c) If we have null, look for a frame element whose 'name' attribute is

  //     "dolske".

  //

  // Unfortunately, (c) would require some engineering effort to be performant

  // in Gecko, and probably in other UAs as well. So we go with a simpler

  // approximation of the above. This approximation will only break sites that

  // rely on their cross-origin subframes setting window.name to a known value,

  // which is unlikely to be very common. And while it does introduce a

  // dependency on cross-origin state when doing global lookups, it doesn't

  // allow the child to arbitrarily pollute the parent namespace, and requires

  // cross-origin communication only in a limited set of cases that can be

  // computed independently by the parent.

  return e && e->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,

                             aNameBeingResolved, eCaseMatters);

}

bool

WindowNamedPropertiesHandler::getOwnPropDescriptor(JSContext* aCx,

                                                   JS::Handle<JSObject*> aProxy,

                                                   JS::Handle<jsid> aId,

                                                   bool /* unused */,

                                                   JS::MutableHandle<JS::PropertyDescriptor> aDesc)

                                                   const

{

  if (!JSID_IS_STRING(aId)) {

    // Nothing to do if we're resolving a non-string property.

    return true;

  }

  bool hasOnPrototype;

  if (!HasPropertyOnPrototype(aCx, aProxy, aId, &hasOnPrototype)) {

    return false;

  }

  if (hasOnPrototype) {

    return true;

  }

  nsAutoJSString str;

  if (!str.init(aCx, JSID_TO_STRING(aId))) {

    return false;

  }

  if(str.IsEmpty()) {

    return true;

  }

  // Grab the DOM window.

  nsGlobalWindowInner* win = xpc::WindowGlobalOrNull(aProxy);

  if (win->Length() > 0) {

    nsCOMPtr<nsPIDOMWindowOuter> childWin = win->GetChildWindow(str);

    if (childWin && ShouldExposeChildWindow(str, childWin)) {

      // We found a subframe of the right name. Shadowing via |var foo| in

      // global scope is still allowed, since |var| only looks up |own|

      // properties. But unqualified shadowing will fail, per-spec.

      JS::Rooted<JS::Value> v(aCx);

      if (!ToJSValue(aCx, nsGlobalWindowOuter::Cast(childWin), &v)) {

        return false;

      }

      FillPropertyDescriptor(aDesc, aProxy, 0, v);

      return true;

    }

  }

  // The rest of this function is for HTML documents only.

  nsCOMPtr<nsIHTMLDocument> htmlDoc = do_QueryInterface(win->GetExtantDoc());

  if (!htmlDoc) {

    return true;

  }

  nsHTMLDocument* document = static_cast<nsHTMLDocument*>(htmlDoc.get());

  JS::Rooted<JS::Value> v(aCx);

  Element* element = document->GetElementById(str);

  if (element) {

    if (!ToJSValue(aCx, element, &v)) {

      return false;

    }

    FillPropertyDescriptor(aDesc, aProxy, 0, v);

    return true;

  }

  ErrorResult rv;

  bool found = document->ResolveName(aCx, str, &v, rv);

  if (rv.MaybeSetPendingException(aCx)) {

    return false;

  }

  if (found) {

    FillPropertyDescriptor(aDesc, aProxy, 0, v);

  }

  return true;

}

bool

WindowNamedPropertiesHandler::defineProperty(JSContext* aCx,

                                             JS::Handle<JSObject*> aProxy,

                                             JS::Handle<jsid> aId,

                                             JS::Handle<JS::PropertyDescriptor> aDesc,

                                             JS::ObjectOpResult &result) const

{

  ErrorResult rv;

  rv.ThrowTypeError<MSG_DEFINEPROPERTY_ON_GSP>();

  MOZ_ALWAYS_TRUE(rv.MaybeSetPendingException(aCx));

  return false;

}

bool

WindowNamedPropertiesHandler::ownPropNames(JSContext* aCx,

                                           JS::Handle<JSObject*> aProxy,

                                           unsigned flags,

                                           JS::AutoIdVector& aProps) const

{

  if (!(flags & JSITER_HIDDEN)) {

    // None of our named properties are enumerable.

    return true;

  }

  // Grab the DOM window.

  nsGlobalWindowInner* win = xpc::WindowGlobalOrNull(aProxy);

  nsTArray<nsString> names;

  // The names live on the outer window, which might be null

  nsGlobalWindowOuter* outer = win->GetOuterWindowInternal();

  if (outer) {

    nsDOMWindowList* childWindows = outer->GetFrames();

    if (childWindows) {

      uint32_t length = childWindows->GetLength();

      for (uint32_t i = 0; i < length; ++i) {

        nsCOMPtr<nsIDocShellTreeItem> item =

          childWindows->GetDocShellTreeItemAt(i);

        // This is a bit silly, since we could presumably just do

        // item->GetWindow().  But it's not obvious whether this does the same

        // thing as GetChildWindow() with the item's name (due to the complexity

        // of FindChildWithName).  Since GetChildWindow is what we use in

        // getOwnPropDescriptor, let's try to be consistent.

        nsString name;

        item->GetName(name);

        if (!names.Contains(name)) {

          // Make sure we really would expose it from getOwnPropDescriptor.

          nsCOMPtr<nsPIDOMWindowOuter> childWin = win->GetChildWindow(name);

          if (childWin && ShouldExposeChildWindow(name, childWin)) {

            names.AppendElement(name);

          }

        }

      }

    }

  }

  if (!AppendNamedPropertyIds(aCx, aProxy, names, false, aProps)) {

    return false;

  }

  names.Clear();

  nsCOMPtr<nsIHTMLDocument> htmlDoc = do_QueryInterface(win->GetExtantDoc());

  if (!htmlDoc) {

    return true;

  }

  nsHTMLDocument* document = static_cast<nsHTMLDocument*>(htmlDoc.get());

  // Document names are enumerable, so we want to get them no matter what flags

  // is.

  document->GetSupportedNames(names);

  JS::AutoIdVector docProps(aCx);

  if (!AppendNamedPropertyIds(aCx, aProxy, names, false, docProps)) {

    return false;

  }

  return js::AppendUnique(aCx, aProps, docProps);

}

bool

WindowNamedPropertiesHandler::delete_(JSContext* aCx,

                                      JS::Handle<JSObject*> aProxy,

                                      JS::Handle<jsid> aId,

                                      JS::ObjectOpResult &aResult) const

{

  return aResult.failCantDeleteWindowNamedProperty();

}

// Note that this class doesn't need any reserved slots, but SpiderMonkey

// asserts all proxy classes have at least one reserved slot.

static const DOMIfaceAndProtoJSClass WindowNamedPropertiesClass = {

  PROXY_CLASS_DEF("WindowProperties",

                  JSCLASS_IS_DOMIFACEANDPROTOJSCLASS |

                  JSCLASS_HAS_RESERVED_SLOTS(1)),

  eNamedPropertiesObject,

  false,

  prototypes::id::_ID_Count,

  0,

  &sEmptyNativePropertyHooks,

  "[object WindowProperties]",

  EventTarget_Binding::GetProtoObject

};

// static

JSObject*

WindowNamedPropertiesHandler::Create(JSContext* aCx,

                                     JS::Handle<JSObject*> aProto)

{

  // Note: since the scope polluter proxy lives on the window's prototype

  // chain, it needs a singleton type to avoid polluting type information

  // for properties on the window.

  js::ProxyOptions options;

  options.setSingleton(true);

  options.setClass(&WindowNamedPropertiesClass.mBase);

  JS::Rooted<JSObject*> gsp(aCx);

  gsp = js::NewProxyObject(aCx, WindowNamedPropertiesHandler::getInstance(),

                           JS::NullHandleValue, aProto,

                           options);

  if (!gsp) {

    return nullptr;

  }

  bool succeeded;

  if (!JS_SetImmutablePrototype(aCx, gsp, &succeeded)) {

    return nullptr;

  }

  MOZ_ASSERT(succeeded,

             "errors making the [[Prototype]] of the named properties object "

             "immutable should have been JSAPI failures, not !succeeded");

  return gsp;

}

} // namespace dom

} // namespace mozilla