Bug 2032140 - Verify content process identity when linking background channels a=dmeehan (b92df16f) · Commits · The Tor Project / Applications / Tor Browser

ipc/glue/BackgroundParentImpl.cpp

+6 −1

Original line number	Diff line number	Diff line
		@@ -1093,7 +1093,12 @@ BackgroundParentImpl::RecvPHttpBackgroundChannelConstructor(
		net::HttpBackgroundChannelParent* aParent =
		static_cast<net::HttpBackgroundChannelParent*>(aActor);

		if (NS_WARN_IF(NS_FAILED(aParent->Init(aChannelId)))) {
		// Record the content process that owns this PBackground actor, so the
		// background channel can only ever be paired with a HttpChannelParent
		// from the same process.
		dom::ContentParentId cpId(BackgroundParent::GetChildID(this));

		if (NS_WARN_IF(NS_FAILED(aParent->Init(cpId, aChannelId)))) {
		return IPC_FAIL_NO_REASON(this);
		}

+7 −0

Original line number	Diff line number	Diff line
		@@ -49,6 +49,13 @@ void BackgroundChannelRegistrar::NotifyChannelLinked(
		MOZ_ASSERT(aChannelParent);
		MOZ_ASSERT(aBgParent);

		// Only link the two actors when they originate from the same content
		// process, since the channel Id used as the key is supplied by
		// the content process.
		if (aChannelParent->GetContentParentId() != aBgParent->GetContentParentId()) {
		return;
		}

		aBgParent->LinkToChannel(aChannelParent);
		aChannelParent->OnBackgroundParentReady(aBgParent);
		}

+4 −1

Original line number	Diff line number	Diff line
		@@ -83,12 +83,15 @@ HttpBackgroundChannelParent::~HttpBackgroundChannelParent() {
		MOZ_ASSERT(!mIPCOpened);
		}

		nsresult HttpBackgroundChannelParent::Init(const uint64_t& aChannelId) {
		nsresult HttpBackgroundChannelParent::Init(const dom::ContentParentId& aCpId,
		const uint64_t& aChannelId) {
		LOG(("HttpBackgroundChannelParent::Init [this=%p channelId=%" PRIu64 "]\n",
		this, aChannelId));
		AssertIsInMainProcess();
		AssertIsOnBackgroundThread();

		mContentParentId = aCpId;

		RefPtr<ContinueAsyncOpenRunnable> runnable =
		new ContinueAsyncOpenRunnable(this, aChannelId);

+13 −3

Original line number	Diff line number	Diff line
		@@ -11,6 +11,7 @@
		#include "mozilla/net/PHttpBackgroundChannelParent.h"
		#include "mozilla/Atomics.h"
		#include "mozilla/Mutex.h"
		#include "mozilla/dom/ipc/IdType.h"
		#include "nsID.h"
		#include "nsISupportsImpl.h"

		@@ -27,9 +28,14 @@ class HttpBackgroundChannelParent final : public PHttpBackgroundChannelParent {

		NS_INLINE_DECL_THREADSAFE_REFCOUNTING(HttpBackgroundChannelParent, final)

		// Try to find associated HttpChannelParent with the same
		// channel Id.
		nsresult Init(const uint64_t& aChannelId);
		// Try to find associated HttpChannelParent with the same content process
		// and channel Id.
		nsresult Init(const dom::ContentParentId& aCpId, const uint64_t& aChannelId);

		// The content process that opened this background channel. Used by
		// BackgroundChannelRegistrar to ensure the channel is only linked to a
		// HttpChannelParent belonging to the same process.
		dom::ContentParentId GetContentParentId() const { return mContentParentId; }

		// Callbacks for BackgroundChannelRegistrar to notify
		// the associated HttpChannelParent is found.
		@@ -114,6 +120,10 @@ class HttpBackgroundChannelParent final : public PHttpBackgroundChannelParent {

		nsCOMPtr<nsISerialEventTarget> mBackgroundThread;

		// The content process that opened this background channel, set once in Init
		// before the actor is registered.
		dom::ContentParentId mContentParentId;

		// associated HttpChannelParent for generating the channel events
		RefPtr<HttpChannelParent> mChannelParent;
		};

+4 −0

Original line number	Diff line number	Diff line
		@@ -213,6 +213,10 @@ void HttpChannelParent::TryInvokeAsyncOpen(nsresult aRv) {
		InvokeAsyncOpen(aRv);
		}

		dom::ContentParentId HttpChannelParent::GetContentParentId() const {
		return static_cast<ContentParent*>(Manager()->Manager())->ChildID();
		}

		void HttpChannelParent::OnBackgroundParentReady(
		HttpBackgroundChannelParent* aBgParent) {
		LOG(("HttpChannelParent::OnBackgroundParentReady [this=%p bgParent=%p]\n",