Verified Commit 5e41c40e authored by Tom Schuster's avatar Tom Schuster Committed by ma1
Browse files

Bug 2008369 - Validate principal in PContent::LoadURIExternal. a=dmeehan DONTBUILD 

Original Revision: https://phabricator.services.mozilla.com/D309362

Differential Revision: https://phabricator.services.mozilla.com/D310359
parent d98efa2b

dom/ipc/ContentParent.cpp

+10 −5
Original line number Diff line number Diff line
@@ -4625,7 +4625,7 @@ mozilla::ipc::IPCResult ContentParent::RecvAccumulateMixedContentHSTS( 
}



mozilla::ipc::IPCResult ContentParent::RecvLoadURIExternal(

    nsIURI* uri, nsIPrincipal* aTriggeringPrincipal,

    NotNull<nsIURI*> uri, NotNull<nsIPrincipal*> aTriggeringPrincipal,

    nsIPrincipal* aRedirectPrincipal,

    const MaybeDiscarded<BrowsingContext>& aContext,

    bool aWasExternallyTriggered, bool aHasValidUserGestureActivation,
@@ -4634,16 +4634,21 @@ mozilla::ipc::IPCResult ContentParent::RecvLoadURIExternal( 
    return IPC_OK();

  }



  if (!ValidatePrincipal(aTriggeringPrincipal)) {

    return PrincipalValidationIpcFail(aTriggeringPrincipal, this, __func__);

  }



  if (!ValidatePrincipal(aRedirectPrincipal,

                         {ValidatePrincipalOptions::AllowNullPtr})) {

    return PrincipalValidationIpcFail(aRedirectPrincipal, this, __func__);

  }



  nsCOMPtr<nsIExternalProtocolService> extProtService(

      do_GetService(NS_EXTERNALPROTOCOLSERVICE_CONTRACTID));

  if (!extProtService) {

    return IPC_OK();

  }



  if (!uri) {

    return IPC_FAIL(this, "uri must not be null.");

  }



  BrowsingContext* bc = aContext.get();

  extProtService->LoadURI(uri, aTriggeringPrincipal, aRedirectPrincipal, bc,

                          aWasExternallyTriggered,

dom/ipc/ContentParent.h

+1 −1
Original line number Diff line number Diff line
@@ -1015,7 +1015,7 @@ class ContentParent final : public PContentParent, 
  mozilla::ipc::IPCResult RecvSetURITitle(nsIURI* uri, const nsAString& title);



  mozilla::ipc::IPCResult RecvLoadURIExternal(

      nsIURI* uri, nsIPrincipal* triggeringPrincipal,

      NotNull<nsIURI*> uri, NotNull<nsIPrincipal*> triggeringPrincipal,

      nsIPrincipal* redirectPrincipal,

      const MaybeDiscarded<BrowsingContext>& aContext,

      bool aWasExternallyTriggered, bool aHasValidUserGestureActivation,

dom/ipc/PContent.ipdl

+2 −2
Original line number Diff line number Diff line
@@ -1158,8 +1158,8 @@ parent: 
    async StartVisitedQueries(nullable nsIURI[] uri);

    async SetURITitle(nullable nsIURI uri, nsString title);



    async LoadURIExternal(nullable nsIURI uri,

                          nullable nsIPrincipal triggeringPrincipal,

    async LoadURIExternal(nsIURI uri,

                          nsIPrincipal triggeringPrincipal,

                          nullable nsIPrincipal redirectPrincipal,

                          MaybeDiscardedBrowsingContext browsingContext,

                          bool wasExternallyTriggered,

uriloader/exthandler/nsExternalHelperAppService.cpp

+5 −3
Original line number Diff line number Diff line
@@ -1032,11 +1032,13 @@ nsExternalHelperAppService::LoadURI(nsIURI* aURI, 
                                    bool aHasValidUserGestureActivation,

                                    bool aNewWindowTarget) {

  NS_ENSURE_ARG_POINTER(aURI);

  NS_ENSURE_ARG_POINTER(aTriggeringPrincipal);



  if (XRE_IsContentProcess()) {

    mozilla::dom::ContentChild::GetSingleton()->SendLoadURIExternal(

        aURI, aTriggeringPrincipal, aRedirectPrincipal, aBrowsingContext,

        aTriggeredExternally, aHasValidUserGestureActivation, aNewWindowTarget);

        WrapNotNull(aURI), WrapNotNull(aTriggeringPrincipal),

        aRedirectPrincipal, aBrowsingContext, aTriggeredExternally,

        aHasValidUserGestureActivation, aNewWindowTarget);

    return NS_OK;

  }
@@ -1104,7 +1106,7 @@ nsExternalHelperAppService::LoadURI(nsIURI* aURI, 
  // links can always navigate everywhere, so this is a minor additional

  // restriction, only aiming to prevent some types of spoofing attacks

  // from otherwise disjoint browsingcontext trees.

  if (aBrowsingContext && aTriggeringPrincipal &&

  if (aBrowsingContext &&

      // Add-on principals are always allowed:

      !BasePrincipal::Cast(aTriggeringPrincipal)->AddonPolicy() &&

      // As is chrome code: