Firefox XPCOM组件 - 权限被拒绝调用方法UnnamedClass [英] Firefox XPCOM component - Permission denied to call method UnnamedClass

问题描述

一个firefox XPCOM组件可以在多个页面上读写页面内容吗？

场景：
一堆本地的HTML和javascript文件。一个Main.html文件打开一个窗口pluginWindow，并创建一个插件使用：



netscape.security.PrivilegeManager.enablePrivilege（'UniversalXPConnect '）;

var obj = Components.classes [cid] .createInstance（）;

plugin = obj.QueryInterface（Components.interfaces.IPlugin）;

plugin.addObserver（handleEvent）;


具有3个方法的插件

IPlugin.Read - 从插件读取数据

IPlugin.Write - 将数据写入插件信读范讯范范辛辛中作信范中中当中信息当中范信信息中的信息中作信息中中的信息信息中作信息中信息中读.html，然后调用pluginWindow并尝试调用插件方法Write。

我收到一个错误：

<首先，我们可以通过调用方法来调用方法UnnamedClass.Write来解决这个问题，是你的C ++代码真的是一个插件或一个 XPCOM组件，可能作为扩展名？听起来就像是后者。

如果是这样，它不可用于不受信任的JS代码 - 任何网页或本地HTML文件。它可以从特权代码完全使用，其中最常见的类型是扩展代码。 p>

使用 enablePrivilege（'UniversalXPConnect'）调用创建组件时，您正在解决此问题。这不是真的建议，除非这不会被分配给用户（因为这个调用会弹出一个混淆的框，如果你设置一个首选项，总是允许file：//脚本使用XPCOM，这可能是一个安全问题，因为不是所有的本地页面是可信的 - 认为保存的网页）。

您的写入调用失败，原因相同 - file：/ /页面不被信任使用XPCOM组件。信息范读辛读内需读范秘范信读中当信范或信息上范范信息亦读信亦亦信息当读亦作内预区>根据具体情况，可能会有更好的解决方案。

如果您的文件必须被视为可信，您可能需要将它们打包为一个扩展名并通过一个chrome：//网址。这给了这些页面的代码权限来调用任何XPCOM组件，包括你的。

如果组件的方法可以安全地从任何页面使用，或者如果控制环境在浏览器中不加载不可信任的页面，可以使组件可访问内容（在 mozilla中搜索nsSidebar项目亦读范读预读信息范读信息信息范读信息亦亦信息的预亦作亦信息范讯信息作范范亦亦信息中的信息空间信息上信息一个chrome：//脚本。或者，您应该能够使用代码（如这个（请注意，它与你需要的相反 - 剥离chrome权限）。

Can a firefox XPCOM component read and write page content across multiple pages?

Scenario: A bunch of local HTML and javascript files. A "Main.html" file opens a window "pluginWindow", and creates a plugin using:

netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
var obj = Components.classes[cid].createInstance();
plugin = obj.QueryInterface(Components.interfaces.IPlugin);
plugin.addObserver(handleEvent);

The plugin that has 3 methods.

IPlugin.Read - Read data from plugin
IPlugin.Write - Write data to the plugin
IPlugin.addObserver - Add a callback handler for reading.

The "Main.html" then calls into the pluginWindow and tries to call the plugin method Write.

I receive an error:

Permission denied to call method UnnamedClass.Write

解决方案

First, is your C++ code really a plugin or an XPCOM component, possibly installed as part of an extension? Sounds like it's the later.

If so, it's not usable from untrusted JS code - any web page or a local HTML file. It's fully usable from privileged code, the most common type of which is the extension code.

You're working around this problem when creating the component using the enablePrivilege('UniversalXPConnect') call. This is not really recommended, unless this will not be distributed to users (since this call pops a confusing box and if you set a preference to always allow file:// scripts use XPCOM, it may be a security problem, since not all local pages are trusted - think saved web pages).

Your Write call fails for the same reason - file:// pages are not trusted to use XPCOM components. You probably can get it to work if you add another enablePrivilege call in the same function as the Write call itself.

Depending on the situation, there may be a better solution.

If your files must be treated as trusted, you may want to package them as an extension and access them via a chrome:// URL. This gives the code in those pages permissions to call any XPCOM component, including yours.

If the component's methods are safe to use from any page or if the environment is controlled and no untrusted pages are loaded in the browser, you could make your component accessible to content (search for nsSidebar in mozilla code for an example and also for nsISecurityCheckedComponent).

Oh, and when you don't get good answers here, you should definitely try the mozilla newsgroups/mailing lists.

[edit in reply to a comment] Consider putting the code that needs to call the component in a chrome:// script. Alternatively, you should be able to "bless" your pages with the chrome privileges using code like this (note that it does the opposite of what you need - stripping away the chrome privileges).

这篇关于Firefox XPCOM组件 - 权限被拒绝调用方法UnnamedClass的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！