Commit b7188e11 authored by Alexandra Borovova's avatar Alexandra Borovova Committed by aborovova@mozilla.com
Browse files

Bug 1959372 - [webdriver-bidi] Add support for "acceptInsecureCerts" argument...

Bug 1959372 - [webdriver-bidi] Add support for "acceptInsecureCerts" argument to "browser.createUserContext" command. r=webdriver-reviewers,jdescottes

Differential Revision: https://phabricator.services.mozilla.com/D247748
parent 7f43d492
Loading
Loading
Loading
Loading
+75 −20
Original line number Diff line number Diff line
@@ -23,35 +23,90 @@ XPCOMUtils.defineLazyServiceGetter(
const CERT_PINNING_ENFORCEMENT_PREF = "security.cert_pinning.enforcement_level";
const HSTS_PRELOAD_LIST_PREF = "network.stricttransportsecurity.preloadlist";

let requiredPreferencesSet = false;

/** @namespace */
export const Certificates = {};

/**
 * Disable all security check and allow all certs.
 * Disable all security checks and allow all certs
 * per user context or globally.
 *
 * @param {string=} userContextId
 *    Id of the user context to disable all security checks
 *    and allow all certs for it. If not provided, disable globally.
 */
Certificates.disableSecurityChecks = function () {
  // make it possible to register certificate overrides for domains
  // that use HSTS or HPKP
Certificates.disableSecurityChecks = function (userContextId = null) {
  if (!requiredPreferencesSet) {
    requiredPreferencesSet = true;

    // Make it possible to register certificate overrides for domains that use HSTS or HPKP.
    // Disable HTTP Strict Transport Security (HSTS) preload list.
    // That means that for the websites from HSTS preload list
    // HTTPS is not going to be enforced until the website is visited.
    Services.prefs.setBoolPref(HSTS_PRELOAD_LIST_PREF, false);
    // Disable preloaded static public key pins.
    // Which means that the public key hashes of certificates
    // will not be validated against the list of static public key pins.
    Services.prefs.setIntPref(CERT_PINNING_ENFORCEMENT_PREF, 0);
  }

  if (userContextId === null) {
    lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
      true
    );
  } else {
    lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext(
      userContextId,
      true
    );
  }
};

/**
 * Enable all security check.
 * Enable all security checks and allow all certs
 * per user context or globally.
 *
 * @param {string=} userContextId
 *    Id of the user context to enable all security checks
 *    and allow all certs for it. If not provided, enable globally.
 *    Note: if the security checks are enabled for a user context but disabled globally
 *    we will still have HSTS preload list and preloaded static key pins disabled
 *    for this user context.
 */
Certificates.enableSecurityChecks = function () {
Certificates.enableSecurityChecks = function (userContextId = null) {
  if (userContextId === null) {
    lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
      false
    );
  } else {
    lazy.certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext(
      userContextId,
      false
    );
  }

  // TODO Bug 1862018. Reconsider when supporting multiple sessions.
  if (userContextId === null) {
    Services.prefs.clearUserPref(HSTS_PRELOAD_LIST_PREF);
    Services.prefs.clearUserPref(CERT_PINNING_ENFORCEMENT_PREF);

    // clear collected HSTS and HPKP state
    // through the site security service
    lazy.sss.clearAll();

    requiredPreferencesSet = false;
  }
};

/**
 * Reset security settings which were set for a user context.
 *
 * @param {string} userContextId
 *    Id of the user context to reset all security checks.
 */
Certificates.resetSecurityChecksForUserContext = function (userContextId) {
  lazy.certOverrideService.resetDisableAllSecurityChecksAndLetAttackersInterceptMyDataForUserContext(
    userContextId
  );
};
+50 −2
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ const lazy = {};

ChromeUtils.defineESModuleGetters(lazy, {
  assert: "chrome://remote/content/shared/webdriver/Assert.sys.mjs",
  Certificates: "chrome://remote/content/shared/webdriver/Certificates.sys.mjs",
  error: "chrome://remote/content/shared/webdriver/Errors.sys.mjs",
  getWebDriverSessionById:
    "chrome://remote/content/shared/webdriver/Session.sys.mjs",
@@ -68,11 +69,26 @@ ChromeUtils.defineESModuleGetters(lazy, {
 */

class BrowserModule extends RootBiDiModule {
  #userContextsWithInsecureCertificatesOverrides;

  constructor(messageHandler) {
    super(messageHandler);

    // A set of internal user context ids to keep track of user contexts
    // which had insecure certificates overrides set for them.
    this.#userContextsWithInsecureCertificatesOverrides = new Set();
  }

  destroy() {}
  destroy() {
    // Reset "allowInsecureCerts" for the userContexts,
    // which were created in the scope of this session.
    for (const userContext of this
      .#userContextsWithInsecureCertificatesOverrides) {
      lazy.Certificates.resetSecurityChecksForUserContext(userContext);
    }

    this.#userContextsWithInsecureCertificatesOverrides = null;
  }

  /**
   * Commands
@@ -130,11 +146,36 @@ class BrowserModule extends RootBiDiModule {
  /**
   * Creates a user context.
   *
   * @param {object=} options
   * @param {boolean=} options.acceptInsecureCerts
   *     Indicates whether untrusted and self-signed TLS certificates
   *     should be implicitly trusted on navigation for this user context.
   *
   * @returns {UserContextInfo}
   *     UserContextInfo object for the created user context.
   */
  async createUserContext() {
  async createUserContext(options = {}) {
    const { acceptInsecureCerts = null } = options;

    if (acceptInsecureCerts !== null) {
      lazy.assert.boolean(
        acceptInsecureCerts,
        lazy.pprint`Expected "acceptInsecureCerts" to be a boolean, got ${acceptInsecureCerts}`
      );
    }

    const userContextId = lazy.UserContextManager.createContext("webdriver");
    const internalId = lazy.UserContextManager.getInternalIdById(userContextId);

    if (acceptInsecureCerts !== null) {
      this.#userContextsWithInsecureCertificatesOverrides.add(internalId);
      if (acceptInsecureCerts) {
        lazy.Certificates.disableSecurityChecks(internalId);
      } else {
        lazy.Certificates.enableSecurityChecks(internalId);
      }
    }

    return { userContext: userContextId };
  }

@@ -186,9 +227,16 @@ class BrowserModule extends RootBiDiModule {
        `User Context with id ${userContextId} was not found`
      );
    }

    const internalId = lazy.UserContextManager.getInternalIdById(userContextId);

    lazy.UserContextManager.removeUserContext(userContextId, {
      closeContextTabs: true,
    });

    // Reset the state to clean up the platform state.
    lazy.Certificates.resetSecurityChecksForUserContext(internalId);
    this.#userContextsWithInsecureCertificatesOverrides.delete(internalId);
  }

  #getClientWindowInfo(window) {