Verified Commit 8ad8ffda authored by Nika Layzell's avatar Nika Layzell Committed by ma1
Browse files

Bug 2027207 - Part 1: Align validation in TriggerRedirectToRealChannel and... 

Bug 2027207 - Part 1: Align validation in TriggerRedirectToRealChannel and RecvNewWindowGlobal better,  a=pascalc

This should make TriggerRedirectToRealChannel tighter, to hopefully
match the check in RecvNewWindowGlobal better. While this doesn't add
much in terms of security, it should reduce the risk of us encountering
surprising errors.

Original Revision: https://phabricator.services.mozilla.com/D291061

Differential Revision: https://phabricator.services.mozilla.com/D311158
parent fa458fcf

dom/ipc/BrowserParent.cpp

+13 −24
Original line number Diff line number Diff line
@@ -1383,34 +1383,23 @@ IPCResult BrowserParent::RecvNewWindowGlobal( 
    return IPC_FAIL(this, "Cannot create without valid principal");

  }



  nsCOMPtr<nsIURI> docURI = aInit.documentURI();

  WindowGlobalParent* parentWgp = browsingContext->GetParentWindowContext();



  // Ensure we never load a document with a content principal in

  // the wrong type of webIsolated process

  // NOTE: Keep this in sync with the similar check in

  // DocumentLoadListener::TriggerRedirectToRealChannel.

  EnumSet<ValidatePrincipalOptions> validationOptions = {};

  nsCOMPtr<nsIURI> docURI = aInit.documentURI();

  if (docURI->SchemeIs("blob") || docURI->SchemeIs("chrome")) {

    // XXXckerschb TODO - Do not use SystemPrincipal for:

    // Bug 1699385: Remove allowSystem for blobs

    // Bug 1698087: chrome://devtools/content/shared/webextension-fallback.html

    // chrome reftests, e.g.

    //   * chrome://reftest/content/writing-mode/ua-style-sheet-button-1a-ref.html

    //   * chrome://reftest/content/xul-document-load/test003.xhtml

    //   * chrome://reftest/content/forms/input/text/centering-1.xhtml

    validationOptions = {ValidatePrincipalOptions::AllowSystem};

  }



  // Some reftests have frames inside their chrome URIs and those load

  // about:blank:

  if (xpc::IsInAutomation() && docURI->SchemeIs("about")) {

    WindowGlobalParent* wgp = browsingContext->GetParentWindowContext();

    nsAutoCString spec;

    NS_ENSURE_SUCCESS(docURI->GetSpec(spec),

                      IPC_FAIL(this, "Should have spec for about: URI"));

    if (spec.Equals("about:blank") && wgp &&

        wgp->DocumentPrincipal()->IsSystemPrincipal()) {

      validationOptions = {ValidatePrincipalOptions::AllowSystem};

  // FIXME(bug 1699385): Remove allowSystem for blobs

  // FIXME(bug 1698087): chrome://devtools/**/webextension-fallback.html

  // Automation-Only: chrome://reftest/** + blank subframes

  if (docURI->SchemeIs("blob") || docURI->SchemeIs("chrome") ||

      (xpc::IsInAutomation() && NS_IsAboutBlank(docURI) && parentWgp &&

       parentWgp->Manager() == this &&

       parentWgp->DocumentPrincipal()->IsSystemPrincipal())) {

    validationOptions += ValidatePrincipalOptions::AllowSystem;

  }

  }



  if (!Manager()->ValidatePrincipal(aInit.principal(), validationOptions)) {

    ContentParent::LogAndAssertFailedPrincipalValidationInfo(aInit.principal(),

                                                             __func__);

netwerk/ipc/DocumentLoadListener.cpp

+32 −13
Original line number Diff line number Diff line
@@ -2370,20 +2370,39 @@ void DocumentLoadListener::TriggerRedirectToRealChannel( 
    return;

  }



  // Checks related to loads which will complete in a content process.

  //

  // These checks are skipped for silent error loads, as those never process

  // switch, and should not result in a document being loaded in the content

  // process.

  if (contentParent && !silentErrorLoad) {

    nsCOMPtr<nsIURI> docURI;

    MOZ_ALWAYS_SUCCEEDS(

        NS_GetFinalChannelURI(mChannel, getter_AddRefs(docURI)));



    // Validate that the target process, if specified, would be allowed to load

    // this principal, and fail the navigation if it would not.

  // Don't enforce this requirement for silent error loads, as those never

  // process switch, and should not result in a document being loaded in the

  // content process.

  // System principals are allowed for now, as they are used in some edge-cases.

  if (!silentErrorLoad && contentParent &&

      !contentParent->ValidatePrincipal(

          unsandboxedPrincipal, {ValidatePrincipalOptions::AllowSystem})) {

    // NOTE: Keep this in sync with the similar check in

    // BrowserParent::RecvNewWindowGlobal.

    EnumSet<ValidatePrincipalOptions> validationOptions = {};

    // FIXME(bug 1699385): Remove allowSystem for blobs

    // FIXME(bug 1698087): chrome://devtools/**/webextension-fallback.html

    // Automation-Only: chrome://reftest/** + blank subframes

    if (docURI->SchemeIs("blob") || docURI->SchemeIs("chrome") ||

        (xpc::IsInAutomation() && NS_IsAboutBlank(docURI) &&

         GetParentWindowContext() &&

         GetParentWindowContext()->Manager()->Manager() == contentParent &&

         GetParentWindowContext()->DocumentPrincipal()->IsSystemPrincipal())) {

      validationOptions += ValidatePrincipalOptions::AllowSystem;

    }

    if (!contentParent->ValidatePrincipal(unsandboxedPrincipal,

                                          validationOptions)) {

      ContentParent::LogAndAssertFailedPrincipalValidationInfo(

          unsandboxedPrincipal, "TriggerRedirectToRealChannel");

      RedirectToRealChannelFinished(NS_ERROR_FAILURE);

      return;

    }

  }



  // Ensure that the BrowsingContextGroup which will finish this load has the

  // UseOriginAgentCluster flag set to a value. We'll try to base it on