Right, so we all know what protected scripts, trusted windows and
trusted objects are [1].
All I want to do here is outline a problem with the model, I haven't
thought about ways to solve it (or whether anyone else will care - they
often don't).
- Everyone loves extensions [2].
- Everyone loves tabs.
- Everyone tries to load everything into a tab.
- Tabs, and the browser view, are (of course) untrusted.
This means you invariably get an (extension's window) untrusted window
loaded with its own code protected. I have been lead to believe that
code loaded 'for' a window automatically has access to its 'owner'
window, or this case would already have fallen over.
The problem is when the window has its own sub-content. Then you get:
+- browser Trusted window + Protected code
+- tab Untrusted window + Protected code
+- sub-content Untrusted window
The code loaded into the tab can't access its own sub-content without
getting attacked by the security manager and XPCNativeWrappers.
Now, the real gotcha here is that the sub-content has been specifically
flagged by the outer window as content it trusts. (What's going on, of
course, is that the browser does NT trust said sub-content.)
I suppose the problem can be thought of in two separate ways:
- The protect code should not be protected, as it is already in an
untrusted place. ( course, not protecting it and at the same time
giving it chrome permissions isn't so nice.)
- The protected code should be allowed access to the sub-content
because it is a child of the code's "own" window and is flagged trusted
in that window.
Would it make sense to have a "trust tree" kinda thing, where the page
in the tab can properly trust itself and its sub-content, but have
neither trusted by the browser?
/discuss

Boris Zbarsky wrote:
James Ross wrote:
>Would it make sense to have a "trust tree" kinda thing, where the page
>in the tab can properly trust itself and its sub-content, but have
>neither trusted by the browser?

Possibly, but I still think it would be easier to just always load
chrome code in trusted windows and strip privileges when it's loaded in
untrusted ones.

If it can be made so that any browser tab with a chrome URI loaded is
not marked as content (or otherwise considered trusted), that might be
enough, but I know perfectly well that the bug relating to that has been
dead for ages

Boris Zbarsky wrote:
James Ross wrote:
>but I know perfectly well that the bug relating to that has been
>dead for ages

Which bug is this?

Bug 286651, specifically comments 3 through 5.

Also, from my point of view, I do *not* want to open anything in a tab
myself, the users' do. That means they will enter a chrome URI and that
is what needs to work in my book.