XRayWrapper error caused by mozRTCPeerConnection instrumentation

[englehardt]

Instrumenting mozRTCPeerConnection.prototype causes the following error:

XrayWrapper denied access to property 0 (reason: value is callable). See https://developer.mozilla.org/en-US/docs/Xray_vision for more information. Note that only the first denied property access from a given global object will be reported.

on line 282 of content.js, which is the return statement of logFunction:

function logFunction(object, objectName, method) {
  var originalMethod = object[method];
  object[method] = function () {
    var scriptUrl = getOriginatingScriptUrl();
    logCall(objectName + '.' + method, arguments, scriptUrl);
    return originalMethod.apply(this, arguments);
  };
}

The error is triggered by line 28-30 of the test page. Specifically, the code block:

connection.createOffer(function(a) {
    connection.setLocalDescription(a)
}, function(err) {})

This only occurs when mozRTCPeerConnection.createOffer is instrumented. It seems that the Xray Vision wrapper blocks the call to apply when a page script defined function is included as an argument.

A security boundary exists between our content script (content.js) and the page script (included in webrtc_localip.html). To waive Xray Vision, we set window = unsafeWindow at the start of the content script, which is enough for editing the properties of built-in objects. This is confirmed by the Xray Vision documentation.

In Add-on SDK content scripts and GreaseMonkey user scripts, you can use the global unsafeWindow...

However, it seems that since we save the method in a function variable (i.e. var originalMethod = object[method]; from logFunction) it is saved in the elevated context. Thus when we try to call apply to it later from the page script we receive a security error. To fix this, we'll need to hook originalMethod to something in the page script's context.

[englehardt]

We were unable to fix this through the use of xray waivers. We were ultimately unable to work around the fact that originalMethod.apply(this, arguments) was operating on this object that didn't have XrayVision waived with functional arguments defined in the page script scope (which causes the: XrayWrapper denied access to property 0 (reason: value is callable). error).

Instead, we decided to inject the necessary instrumentation code into the page script, and only have the message passing functions in the content script.

Closed in c9e1ed8