Bug 1959372 - [webdriver-bidi] Add support for "acceptInsecureCerts" argument... (b7188e11) · Commits · The Tor Project / Applications / Tor Browser

remote/shared/webdriver/Certificates.sys.mjs

+75 −20

Original line number	Diff line number	Diff line
		@@ -23,35 +23,90 @@ XPCOMUtils.defineLazyServiceGetter(
		const CERT_PINNING_ENFORCEMENT_PREF = "security.cert_pinning.enforcement_level";
		const HSTS_PRELOAD_LIST_PREF = "network.stricttransportsecurity.preloadlist";

		let requiredPreferencesSet = false;

		/** @namespace */
		export const Certificates = {};

		/**
		* Disable all security check and allow all certs.
		* Disable all security checks and allow all certs
		* per user context or globally.
		*
		* @param {string=} userContextId
		* Id of the user context to disable all security checks
		* and allow all certs for it. If not provided, disable globally.
		*/
		Certificates.disableSecurityChecks = function () {
		// make it possible to register certificate overrides for domains
		// that use HSTS or HPKP
		Certificates.disableSecurityChecks = function (userContextId = null) {
		if (!requiredPreferencesSet) {
		requiredPreferencesSet = true;

		// Make it possible to register certificate overrides for domains that use HSTS or HPKP.
		// Disable HTTP Strict Transport Security (HSTS) preload list.
		// That means that for the websites from HSTS preload list
		// HTTPS is not going to be enforced until the website is visited.
		Services.prefs.setBoolPref(HSTS_PRELOAD_LIST_PREF, false);
		// Disable preloaded static public key pins.
		// Which means that the public key hashes of certificates
		// will not be validated against the list of static public key pins.
		Services.prefs.setIntPref(CERT_PINNING_ENFORCEMENT_PREF, 0);
		}

		if (userContextId === null) {
		lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
		true
		);
		} else {
		lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext(
		userContextId,
		true
		);
		}
		};

		/**
		* Enable all security check.
		* Enable all security checks and allow all certs
		* per user context or globally.
		*
		* @param {string=} userContextId
		* Id of the user context to enable all security checks
		* and allow all certs for it. If not provided, enable globally.
		* Note: if the security checks are enabled for a user context but disabled globally
		* we will still have HSTS preload list and preloaded static key pins disabled
		* for this user context.
		*/
		Certificates.enableSecurityChecks = function () {
		Certificates.enableSecurityChecks = function (userContextId = null) {
		if (userContextId === null) {
		lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
		false
		);
		} else {
		lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext(
		userContextId,
		false
		);
		}

		// TODO Bug 1862018. Reconsider when supporting multiple sessions.
		if (userContextId === null) {
		Services.prefs.clearUserPref(HSTS_PRELOAD_LIST_PREF);
		Services.prefs.clearUserPref(CERT_PINNING_ENFORCEMENT_PREF);

		// clear collected HSTS and HPKP state
		// through the site security service
		lazy.sss.clearAll();

		requiredPreferencesSet = false;
		}
		};

		/**
		* Reset security settings which were set for a user context.
		*
		* @param {string} userContextId
		* Id of the user context to reset all security checks.
		*/
		Certificates.resetSecurityChecksForUserContext = function (userContextId) {
		lazy.certOverrideService.resetDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext(
		userContextId
		);
		};

remote/webdriver-bidi/modules/root/browser.sys.mjs

+50 −2

Original line number	Diff line number	Diff line
		@@ -8,6 +8,7 @@ const lazy = {};

		ChromeUtils.defineESModuleGetters(lazy, {
		assert: "chrome://remote/content/shared/webdriver/Assert.sys.mjs",
		Certificates: "chrome://remote/content/shared/webdriver/Certificates.sys.mjs",
		error: "chrome://remote/content/shared/webdriver/Errors.sys.mjs",
		getWebDriverSessionById:
		"chrome://remote/content/shared/webdriver/Session.sys.mjs",
		@@ -68,11 +69,26 @@ ChromeUtils.defineESModuleGetters(lazy, {
		*/

		class BrowserModule extends RootBiDiModule {
		#userContextsWithInsecureCertificatesOverrides;

		constructor(messageHandler) {
		super(messageHandler);

		// A set of internal user context ids to keep track of user contexts
		// which had insecure certificates overrides set for them.
		this.#userContextsWithInsecureCertificatesOverrides = new Set();
		}

		destroy() {}
		destroy() {
		// Reset "allowInsecureCerts" for the userContexts,
		// which were created in the scope of this session.
		for (const userContext of this
		.#userContextsWithInsecureCertificatesOverrides) {
		lazy.Certificates.resetSecurityChecksForUserContext(userContext);
		}

		this.#userContextsWithInsecureCertificatesOverrides = null;
		}

		/**
		* Commands
		@@ -130,11 +146,36 @@ class BrowserModule extends RootBiDiModule {
		/**
		* Creates a user context.
		*
		* @param {object=} options
		* @param {boolean=} options.acceptInsecureCerts
		* Indicates whether untrusted and self-signed TLS certificates
		* should be implicitly trusted on navigation for this user context.
		*
		* @returns {UserContextInfo}
		* UserContextInfo object for the created user context.
		*/
		async createUserContext() {
		async createUserContext(options = {}) {
		const { acceptInsecureCerts = null } = options;

		if (acceptInsecureCerts !== null) {
		lazy.assert.boolean(
		acceptInsecureCerts,
		lazy.pprint`Expected "acceptInsecureCerts" to be a boolean, got ${acceptInsecureCerts}`
		);
		}

		const userContextId = lazy.UserContextManager.createContext("webdriver");
		const internalId = lazy.UserContextManager.getInternalIdById(userContextId);

		if (acceptInsecureCerts !== null) {
		this.#userContextsWithInsecureCertificatesOverrides.add(internalId);
		if (acceptInsecureCerts) {
		lazy.Certificates.disableSecurityChecks(internalId);
		} else {
		lazy.Certificates.enableSecurityChecks(internalId);
		}
		}

		return { userContext: userContextId };
		}

		@@ -186,9 +227,16 @@ class BrowserModule extends RootBiDiModule {
		`User Context with id ${userContextId} was not found`
		);
		}

		const internalId = lazy.UserContextManager.getInternalIdById(userContextId);

		lazy.UserContextManager.removeUserContext(userContextId, {
		closeContextTabs: true,
		});

		// Reset the state to clean up the platform state.
		lazy.Certificates.resetSecurityChecksForUserContext(internalId);
		this.#userContextsWithInsecureCertificatesOverrides.delete(internalId);
		}

		#getClientWindowInfo(window) {