Subj : Re: JS_EvaluateScriptForPrincipals() vs JS_EvaluateScript()
To   : Oystein Hallaraker
From : Brendan Eich
Date : Wed Jun 30 2004 06:12 pm

Oystein Hallaraker wrote:
> Hi!
> I have been looking at the code for the two different api functions 
> JS_EvaluateScriptForPrincipals() and JS_EvaluateScript(). I am reading 
> that the first one is a secure version and takes a JSPrincipals struct 
> as a parameter. But where in the engine is this JSPrincipals struct 
> used? When spiderMonkey is embedded in the mozilla browser, does it 
> matter which of these functions are called, since the access 
> control(same origin) is done in the dom/nsScriptSecurityManager?


If you are embedding in Mozilla (Gecko, one of the apps), and you want 
caps/src/nsScriptSecurityManager.cpp (caps, not dom) to be used, you 
must use nsIScriptContext to call that interface's EvaluateString 
method.    You should not be using the raw JS API.

Obviously, the DOM does use principals, and caps depends on that fact. 
If you trace the control flow in js/src by looking for JSPRINCIPALS_HOLD 
and JSPRINCIPALS_DROP calls, you may start to see the light ;-).  But 
you can use the XPCOM interfaces to caps and dom and not even have to 
worry -- just have faith! ;-)

/be

.