Bug 1460840 - JSON Viewer's converter-child should not trust JSONView without Xrays
MozReview-Commit-ID: BvrVd9cdRaK
--- a/devtools/client/jsonview/converter-child.js
+++ b/devtools/client/jsonview/converter-child.js
@@ -187,41 +187,47 @@ function getHttpHeaders(request) {
}
});
}
return headers;
}
// Exports variables that will be accessed by the non-privileged scripts.
function exportData(win, headers) {
- let data = Cu.createObjectIn(win, {
- defineAs: "JSONView"
+ let json = new win.Text();
+ let JSONView = Cu.cloneInto({
+ debugJsModules,
+ headers,
+ json,
+ readyState: "uninitialized",
+ Locale: {
+ $STR: key => {
+ try {
+ return jsonViewStrings.GetStringFromName(key);
+ } catch (err) {
+ console.error(err);
+ return undefined;
+ }
+ }
+ },
+ }, win, {
+ cloneFunctions: true,
+ wrapReflectors: true,
});
-
- data.debugJsModules = debugJsModules;
-
- data.json = new win.Text();
-
- data.readyState = "uninitialized";
-
- let Locale = {
- $STR: key => {
- try {
- return jsonViewStrings.GetStringFromName(key);
- } catch (err) {
- console.error(err);
- return undefined;
- }
- }
- };
- data.Locale = Cu.cloneInto(Locale, win, {cloneFunctions: true});
-
- data.headers = Cu.cloneInto(headers, win);
-
- return data;
+ try {
+ Object.defineProperty(Cu.waiveXrays(win), "JSONView", {
+ value: JSONView,
+ configurable: true,
+ enumerable: true,
+ writable: true,
+ });
+ } catch (error) {
+ Cu.reportError(error);
+ }
+ return {json};
}
// Builds an HTML string that will be used to load stylesheets and scripts.
function initialHTML(doc) {
// Creates an element with the specified type, attributes and children.
function element(type, attributes = {}, children = []) {
let el = doc.createElement(type);
for (let [attr, value] of Object.entries(attributes)) {