Question

What does Mozilla Firefox’s XPCSafeJSObject wrapper actually do?

MDC‘s documentation is as follows:

This wrapper was created to address some problems with XPCNativeWrapper. In particular, some extensions want to be able to safely access non-natively-implemented content defined objects (and to access the underlying JavaScript object under an XPCNativeWrapper without its strong behavior guarantees). XPCSJOW act as a buffer between the chrome code.

This doesn’t tell me a lot. In particular, I can’t tell how accessing objects via XPCSafeObject is any different to accessing them directly.

Edit: I understand that the purpose of the wrappers in general is to protect privileged code from unprivileged code. What I don’t understand (and doesn’t seem to be documented) is how exactly XPCSafeJSObject does this.

Does it just drop privileges before accessing a property?

Answer 1

The purpose of the wrappers in general is to protect Privileged code when interacting with unprivileged code. The author of the unprivileged code might redefine a JavaScript object to do something malicious, like redefine the getter of a property to execute something bad as a side effect. When the privileged code tries to access the property it would execute the bad code as privileged code. The wrapper prevents this. This page describes the idea.

XPCSafeJSObject provide a wrapper for non-natively implemented JavaScript objects (i.e. not window, document, etc. but user defined objects.)

Edit: For how it’s implemented, check out the source code (it’s not loading completely for me at the moment.) Also search for XPCSafeJSObject on DXR for other relevant source files.