Bug 16998: Isolate link rel=preconnect to first party (3086d13d) · Commits · The Tor Project / Applications / Tor Browser

dom/base/nsDocument.cpp

+6 −2

Original line number	Diff line number	Diff line
		@@ -246,6 +246,8 @@

		#include "nsISpeculativeConnect.h"

		#include "ThirdPartyUtil.h"

		#ifdef MOZ_MEDIA_NAVIGATOR
		#include "mozilla/MediaManager.h"
		#endif // MOZ_MEDIA_NAVIGATOR
		@@ -9750,10 +9752,12 @@ nsDocument::MaybePreconnect(nsIURI* aOrigURI, mozilla::CORSMode aCORSMode)
		return;
		}

		nsCString firstPartyHost;
		ThirdPartyUtil::GetFirstPartyHost(this, firstPartyHost);
		if (aCORSMode == CORS_ANONYMOUS) {
		speculator->SpeculativeAnonymousConnect(uri, nullptr);
		speculator->SpeculativeAnonymousConnectIsolated(uri, firstPartyHost, nullptr);
		} else {
		speculator->SpeculativeConnect(uri, nullptr);
		speculator->SpeculativeConnectIsolated(uri, firstPartyHost, nullptr);
		}
		}

netwerk/base/nsIOService.cpp

+37 −4

Original line number	Diff line number	Diff line
		@@ -51,6 +51,7 @@
		#include "ClosingService.h"
		#include "ReferrerPolicy.h"
		#include "nsContentSecurityManager.h"
		#include "ThirdPartyUtil.h"

		#ifdef MOZ_WIDGET_GONK
		#include "nsINetworkManager.h"
		@@ -1822,10 +1823,14 @@ IOServiceProxyCallback::OnProxyAvailable(nsICancelable request, nsIChannel cha

		nsLoadFlags loadFlags = 0;
		channel->GetLoadFlags(&loadFlags);

		nsCString firstPartyHost;
		ThirdPartyUtil::GetFirstPartyHost(channel, firstPartyHost);

		if (loadFlags & nsIRequest::LOAD_ANONYMOUS) {
		speculativeHandler->SpeculativeAnonymousConnect(uri, mCallbacks);
		speculativeHandler->SpeculativeAnonymousConnectIsolated(uri, firstPartyHost, mCallbacks);
		} else {
		speculativeHandler->SpeculativeConnect(uri, mCallbacks);
		speculativeHandler->SpeculativeConnectIsolated(uri, firstPartyHost, mCallbacks);
		}

		return NS_OK;
		@@ -1833,6 +1838,7 @@ IOServiceProxyCallback::OnProxyAvailable(nsICancelable request, nsIChannel cha

		nsresult
		nsIOService::SpeculativeConnectInternal(nsIURI *aURI,
		const nsACString& aIsolationKey,
		nsIInterfaceRequestor *aCallbacks,
		bool aAnonymous)
		{
		@@ -1867,6 +1873,17 @@ nsIOService::SpeculativeConnectInternal(nsIURI *aURI,
		getter_AddRefs(channel));
		NS_ENSURE_SUCCESS(rv, rv);

		// If we have an isolation key, use it as the document URI for this channel.
		if (!aIsolationKey.IsEmpty()) {
		nsCOMPtr<nsIHttpChannelInternal> channelInternal(do_QueryInterface(channel));
		if (channelInternal) {
		nsCString documentURISpec("https://");
		documentURISpec.Append(aIsolationKey);
		nsCOMPtr<nsIURI> documentURI;
		/* nsresult rv = */ NS_NewURI(getter_AddRefs(documentURI), documentURISpec);
		channelInternal->SetDocumentURI(documentURI);
		}
		}
		if (aAnonymous) {
		nsLoadFlags loadFlags = 0;
		channel->GetLoadFlags(&loadFlags);
		@@ -1884,18 +1901,34 @@ nsIOService::SpeculativeConnectInternal(nsIURI *aURI,
		return pps->AsyncResolve(channel, 0, callback, getter_AddRefs(cancelable));
		}

		NS_IMETHODIMP
		nsIOService::SpeculativeConnectIsolated(nsIURI *aURI,
		const nsACString& aIsolationKey,
		nsIInterfaceRequestor *aCallbacks)
		{
		return SpeculativeConnectInternal(aURI, aIsolationKey, aCallbacks, false);
		}

		NS_IMETHODIMP
		nsIOService::SpeculativeConnect(nsIURI *aURI,
		nsIInterfaceRequestor *aCallbacks)
		{
		return SpeculativeConnectInternal(aURI, aCallbacks, false);
		return SpeculativeConnectInternal(aURI, EmptyCString(), aCallbacks, false);
		}

		NS_IMETHODIMP
		nsIOService::SpeculativeAnonymousConnectIsolated(nsIURI *aURI,
		const nsACString& aIsolationKey,
		nsIInterfaceRequestor *aCallbacks)
		{
		return SpeculativeConnectInternal(aURI, aIsolationKey, aCallbacks, true);
		}

		NS_IMETHODIMP
		nsIOService::SpeculativeAnonymousConnect(nsIURI *aURI,
		nsIInterfaceRequestor *aCallbacks)
		{
		return SpeculativeConnectInternal(aURI, aCallbacks, true);
		return SpeculativeConnectInternal(aURI, EmptyCString(), aCallbacks, true);
		}

		void

netwerk/base/nsIOService.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -133,6 +133,7 @@ private:
		nsIChannel** result);

		nsresult SpeculativeConnectInternal(nsIURI *aURI,
		const nsACString& aIsolationKey,
		nsIInterfaceRequestor *aCallbacks,
		bool aAnonymous);

netwerk/base/nsISpeculativeConnect.idl

+10 −1

Original line number	Diff line number	Diff line
		@@ -8,7 +8,7 @@
		interface nsIURI;
		interface nsIInterfaceRequestor;

		[scriptable, uuid(d74a17ac-5b8a-4824-a309-b1f04a3c4aed)]
		[scriptable, uuid(60cf321d-9f09-403a-b8b6-db221e6ca3a1)]
		interface nsISpeculativeConnect : nsISupports
		{
		/**
		@@ -21,6 +21,7 @@ interface nsISpeculativeConnect : nsISupports
		* to actually open the new channel.
		*
		* @param aURI the URI of the hinted transaction
		* @param aIsolationKey the isolation key for the connection
		* @param aCallbacks any security callbacks for use with SSL for interfaces
		* such as nsIBadCertListener. May be null.
		*
		@@ -30,6 +31,14 @@ interface nsISpeculativeConnect : nsISupports

		void speculativeAnonymousConnect(in nsIURI aURI,
		in nsIInterfaceRequestor aCallbacks);

		void speculativeConnectIsolated(in nsIURI aURI,
		in AUTF8String aIsolationKey,
		in nsIInterfaceRequestor aCallbacks);

		void speculativeAnonymousConnectIsolated(in nsIURI aURI,
		in AUTF8String aIsolationKey,
		in nsIInterfaceRequestor aCallbacks);
		};

		/**

netwerk/ipc/NeckoParent.cpp

+4 −3

Original line number	Diff line number	Diff line
		@@ -728,15 +728,16 @@ NeckoParent::DeallocPRemoteOpenFileParent(PRemoteOpenFileParent* actor)
		}

		bool
		NeckoParent::RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous)
		NeckoParent::RecvSpeculativeConnect(const URIParams& aURI, const bool& aAnonymous,
		const nsCString& aIsolationKey)
		{
		nsCOMPtr<nsISpeculativeConnect> speculator(gIOService);
		nsCOMPtr<nsIURI> uri = DeserializeURI(aURI);
		if (uri && speculator) {
		if (aAnonymous) {
		speculator->SpeculativeAnonymousConnect(uri, nullptr);
		speculator->SpeculativeAnonymousConnectIsolated(uri, aIsolationKey, nullptr);
		} else {
		speculator->SpeculativeConnect(uri, nullptr);
		speculator->SpeculativeConnectIsolated(uri, aIsolationKey, nullptr);
		}

		}