Bug 1328847 - Change SEC_NORMAL to SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL where system principal is used.

Tag #1273

10 files changed, 34 insertions, 20 deletions

diff --git a/mailnews/addrbook/src/nsAbContentHandler.cpp b/mailnews/addrbook/src/nsAbContentHandler.cpp
index 6e283d82bb..3ee00148ca 100644
--- a/mailnews/addrbook/src/nsAbContentHandler.cpp
+++ b/mailnews/addrbook/src/nsAbContentHandler.cpp
@@ -125,7 +125,7 @@ nsAbContentHandler::HandleContent(const char *aContentType,
                             uri,
                             this,
                             nullPrincipal,
-                            nsILoadInfo::SEC_NORMAL,
+                            nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                             nsIContentPolicy::TYPE_OTHER);
     NS_ENSURE_SUCCESS(rv, rv);
 
diff --git a/mailnews/addrbook/src/nsAddbookProtocolHandler.cpp b/mailnews/addrbook/src/nsAddbookProtocolHandler.cpp
index 2d1fab36ed..9507a3cc92 100644
--- a/mailnews/addrbook/src/nsAddbookProtocolHandler.cpp
+++ b/mailnews/addrbook/src/nsAddbookProtocolHandler.cpp
@@ -114,8 +114,11 @@ nsAddbookProtocolHandler::GenerateXMLOutputChannel( nsString &aOutput,
   if (NS_FAILED(rv))
       return rv;
 
-  return NS_NewInputStreamChannel(_retval, aURI, inStr,
-                                  nullPrincipal, nsILoadInfo::SEC_NORMAL,
+  return NS_NewInputStreamChannel(_retval,
+                                  aURI,
+                                  inStr,
+                                  nullPrincipal,
+                                  nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                                   nsIContentPolicy::TYPE_OTHER,
                                   NS_LITERAL_CSTRING("text/xml"));
 }
@@ -180,9 +183,13 @@ nsAddbookProtocolHandler::NewChannel2(nsIURI *aURI,
       if (NS_FAILED(rv))
           return rv;
       
-      return NS_NewInputStreamChannel(_retval, aURI, pipeIn,
-          nullPrincipal, nsILoadInfo::SEC_NORMAL, nsIContentPolicy::TYPE_OTHER,
-          NS_LITERAL_CSTRING("application/x-addvcard"));
+      return NS_NewInputStreamChannel(_retval,
+                                      aURI,
+                                      pipeIn,
+                                      nullPrincipal,
+                                      nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
+                                      nsIContentPolicy::TYPE_OTHER,
+                                      NS_LITERAL_CSTRING("application/x-addvcard"));
   }
 
   nsString output;
diff --git a/mailnews/base/prefs/content/accountcreation/util.js b/mailnews/base/prefs/content/accountcreation/util.js
index d867bfbe96..44c22ac458 100644
--- a/mailnews/base/prefs/content/accountcreation/util.js
+++ b/mailnews/base/prefs/content/accountcreation/util.js
@@ -70,7 +70,7 @@ function readURLasUTF8(uri)
                                               null,
                                               Services.scriptSecurityManager.getSystemPrincipal(),
                                               null,
-                                              Ci.nsILoadInfo.SEC_NORMAL,
+                                              Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                                               Ci.nsIContentPolicy.TYPE_OTHER);
     let is = Cc["@mozilla.org/intl/converter-input-stream;1"]
              .createInstance(Ci.nsIConverterInputStream);
diff --git a/mailnews/base/src/nsMessenger.cpp b/mailnews/base/src/nsMessenger.cpp
index 82fb5b68aa..a13c4adbc4 100644
--- a/mailnews/base/src/nsMessenger.cpp
+++ b/mailnews/base/src/nsMessenger.cpp
@@ -1108,7 +1108,7 @@ nsMessenger::SaveAs(const nsACString& aURI, bool aAsFile,
                                     url,
                                     nullptr,
                                     nullPrincipal,
-                                    nsILoadInfo::SEC_NORMAL,
+                                    nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                                     nsIContentPolicy::TYPE_OTHER);
       NS_ASSERTION(NS_SUCCEEDED(rv), "NS_NewChannel failed");
       if (NS_FAILED(rv))
diff --git a/mailnews/compose/src/nsMsgAttachmentHandler.cpp b/mailnews/compose/src/nsMsgAttachmentHandler.cpp
index f36f2e29b7..0ae253ed6e 100644
--- a/mailnews/compose/src/nsMsgAttachmentHandler.cpp
+++ b/mailnews/compose/src/nsMsgAttachmentHandler.cpp
@@ -663,7 +663,7 @@ nsMsgAttachmentHandler::SnarfMsgAttachment(nsMsgCompFields *compFields)
                                     aURL,
                                     nullptr,
                                     nullPrincipal,
-                                    nsILoadInfo::SEC_NORMAL,
+                                    nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                                     nsIContentPolicy::TYPE_OTHER);
       if (NS_FAILED(rv))
         goto done;
diff --git a/mailnews/compose/src/nsMsgComposeService.cpp b/mailnews/compose/src/nsMsgComposeService.cpp
index 944f7dbe3c..bc202b7df9 100644
--- a/mailnews/compose/src/nsMsgComposeService.cpp
+++ b/mailnews/compose/src/nsMsgComposeService.cpp
@@ -1362,7 +1362,7 @@ nsMsgComposeService::RunMessageThroughMimeDraft(
                      url,
                      nullptr,
                      nullPrincipal,
-                     nsILoadInfo::SEC_NORMAL,
+                     nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                      nsIContentPolicy::TYPE_OTHER);
   NS_ASSERTION(NS_SUCCEEDED(rv), "NS_NewChannel failed.");
   if (NS_FAILED(rv))
diff --git a/mailnews/compose/src/nsMsgQuote.cpp b/mailnews/compose/src/nsMsgQuote.cpp
index ce8e1b5d0b..2bddae520c 100644
--- a/mailnews/compose/src/nsMsgQuote.cpp
+++ b/mailnews/compose/src/nsMsgQuote.cpp
@@ -188,7 +188,7 @@ nsMsgQuote::QuoteMessage(const char *msgURI, bool quoteHeaders,
                                       nullptr,
                                       systemPrincipal,
                                       nullptr,
-                                      nsILoadInfo::SEC_NORMAL,
+                                      nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                                       nsIContentPolicy::TYPE_OTHER,
                                       getter_AddRefs(mQuoteChannel));
 
diff --git a/mailnews/compose/src/nsSmtpService.cpp b/mailnews/compose/src/nsSmtpService.cpp
index 9f9295934f..9409811ff2 100644
--- a/mailnews/compose/src/nsSmtpService.cpp
+++ b/mailnews/compose/src/nsSmtpService.cpp
@@ -357,8 +357,11 @@ NS_IMETHODIMP nsSmtpService::NewChannel2(nsIURI *aURI,
   if (NS_FAILED(rv))
     return rv;
 
-  return NS_NewInputStreamChannel(_retval, aURI, pipeIn,
-                                  nullPrincipal, nsILoadInfo::SEC_NORMAL,
+  return NS_NewInputStreamChannel(_retval,
+                                  aURI,
+                                  pipeIn,
+                                  nullPrincipal,
+                                  nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                                   nsIContentPolicy::TYPE_OTHER,
                                   NS_LITERAL_CSTRING("application/x-mailto"));
 }
diff --git a/mailnews/compose/src/nsURLFetcher.cpp b/mailnews/compose/src/nsURLFetcher.cpp
index b564ab9a4f..ca2dcd7c6c 100644
--- a/mailnews/compose/src/nsURLFetcher.cpp
+++ b/mailnews/compose/src/nsURLFetcher.cpp
@@ -7,7 +7,7 @@
 
 #include "msgCore.h" // for pre-compiled headers
 #include "nsCOMPtr.h"
-#include "nsNullPrincipal.h"
+#include "nsIScriptSecurityManager.h"
 #include <stdio.h>
 #include "nscore.h"
 #include "nsIFactory.h"
@@ -317,15 +317,19 @@ nsURLFetcher::FireURLRequest(nsIURI *aURL, nsIFile *localFile, nsIOutputStream *
   nsCOMPtr<nsIURILoader> pURILoader (do_GetService(NS_URI_LOADER_CONTRACTID));
   NS_ENSURE_TRUE(pURILoader, NS_ERROR_FAILURE);
 
-  nsCOMPtr<nsIPrincipal> nullPrincipal =
-    do_CreateInstance("@mozilla.org/nullprincipal;1", &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsCOMPtr<nsIScriptSecurityManager>
+    secMan(do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv));
+  NS_ENSURE_SUCCESS(rv,rv);
+
+  nsCOMPtr<nsIPrincipal> systemPrincipal;
+  rv = secMan->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
+  NS_ENSURE_SUCCESS(rv,rv);
 
   nsCOMPtr<nsIChannel> channel;
   rv = NS_NewChannel(getter_AddRefs(channel),
                      aURL,
-                     nullPrincipal,
-                     nsILoadInfo::SEC_NORMAL,
+                     systemPrincipal,
+                     nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                      nsIContentPolicy::TYPE_OTHER,
                      nullptr, // aLoadGroup
                      this); // aCallbacks
diff --git a/mailnews/imap/src/nsImapProtocol.cpp b/mailnews/imap/src/nsImapProtocol.cpp
index 73484b2aa2..9d943f7ec6 100644
--- a/mailnews/imap/src/nsImapProtocol.cpp
+++ b/mailnews/imap/src/nsImapProtocol.cpp
@@ -745,7 +745,7 @@ nsresult nsImapProtocol::SetupWithUrl(nsIURI * aURL, nsISupports* aConsumer)
       rv = NS_NewChannel(getter_AddRefs(channel),
                          aURL,
                          nullPrincipal,
-                         nsILoadInfo::SEC_NORMAL,
+                         nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                          nsIContentPolicy::TYPE_OTHER);
       m_mockChannel = do_QueryInterface(channel);