Verified Commit 72bde1d3 authored by Vincent Hilla's avatar Vincent Hilla Committed by ma1
Browse files

Bug 2035756 - Verify srcdoc and data result principal. a=pascalc 

Original Revision: https://phabricator.services.mozilla.com/D309545

Differential Revision: https://phabricator.services.mozilla.com/D311257
parent 82ece4cd

dom/security/nsContentSecurityManager.cpp

+36 −5
Original line number Diff line number Diff line
@@ -1740,16 +1740,18 @@ nsresult nsContentSecurityManager::CheckForIncoherentResultPrincipal( 
    return NS_OK;

  }



  nsCOMPtr<nsIPrincipal> resultOrPrecursor;

  nsCOMPtr<nsIPrincipal> result;

  nsresult rv = nsScriptSecurityManager::GetScriptSecurityManager()

                    ->GetChannelResultPrincipalIfNotSandboxed(

                        aChannel, getter_AddRefs(resultOrPrecursor));

                        aChannel, getter_AddRefs(result));

  NS_ENSURE_SUCCESS(rv, rv);

  NS_ENSURE_STATE(resultOrPrecursor);

  NS_ENSURE_STATE(result);



  if (nsCOMPtr<nsIPrincipal> precursor =

          resultOrPrecursor->GetPrecursorPrincipal()) {

  nsCOMPtr<nsIPrincipal> resultOrPrecursor;

  if (nsCOMPtr<nsIPrincipal> precursor = result->GetPrecursorPrincipal()) {

    resultOrPrecursor = precursor;

  } else {

    resultOrPrecursor = result;

  }



  if (!resultOrPrecursor->GetIsContentPrincipal()) {
@@ -1768,6 +1770,35 @@ nsresult nsContentSecurityManager::CheckForIncoherentResultPrincipal( 
  aChannel->GetURI(getter_AddRefs(channelURI));

  NS_ENSURE_STATE(channelURI);



  if (channelURI->SchemeIs("data") && !result->GetIsNullPrincipal()) {

    // Carve out for `ExtensionPolicyService::GetGeneratedBackgroundPageUrl`:

    if (!BasePrincipal::Cast(result)->AddonPolicy()) {

      MOZ_ASSERT_UNREACHABLE("data URI with a non-null principal");

      return NS_ERROR_CONTENT_BLOCKED;

    }



    nsAutoCString triggeringRemoteType;

    rv = loadInfo->GetTriggeringRemoteType(triggeringRemoteType);

    NS_ENSURE_SUCCESS(rv, rv);



    if (triggeringRemoteType != NOT_REMOTE_TYPE &&

        triggeringRemoteType != EXTENSION_REMOTE_TYPE) {

      MOZ_ASSERT_UNREACHABLE(

          "Generated addon background page in incorrect process");

      return NS_ERROR_CONTENT_BLOCKED;

    }

  }



  if (NS_IsAboutSrcdoc(channelURI)) {

    nsIPrincipal* loadingPrincipal = loadInfo->GetLoadingPrincipal();

    if (!loadingPrincipal || !loadingPrincipal->Subsumes(result)) {

      // This is fine for sandboxed srcdoc because result is unsandboxed.

      MOZ_ASSERT_UNREACHABLE(

          "about:srcdoc result principal not subsumed by embedder");

      return NS_ERROR_CONTENT_BLOCKED;

    }

  }



  nsCOMPtr<nsIPrincipal> channelUriPrincipal =

      BasePrincipal::CreateContentPrincipal(channelURI, {});

  NS_ENSURE_STATE(channelUriPrincipal);