Skip to content

Commit 10c02f0

Browse files
author
Jonathan Kingston
committed
Bug 1485305 - browser/ Ensure loadURI always passes a triggeringPrincipal() r=Mossop
Differential Revision: https://phabricator.services.mozilla.com/D4551 --HG-- extra : source : 2b7baed037199f16100d13e0057a5d1054fca14c
1 parent d67cb9e commit 10c02f0

File tree

12 files changed

+72
-15
lines changed

12 files changed

+72
-15
lines changed

‎browser/actors/BlockedSiteChild.jsm

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ ChromeUtils.import("resource://gre/modules/Services.jsm");
88
var EXPORTED_SYMBOLS = ["BlockedSiteChild"];
99

1010
ChromeUtils.import("resource://gre/modules/ActorChild.jsm");
11+
ChromeUtils.defineModuleGetter(this, "Utils",
12+
"resource://gre/modules/sessionstore/Utils.jsm");
1113

1214
ChromeUtils.defineModuleGetter(this, "SafeBrowsing",
1315
"resource://gre/modules/SafeBrowsing.jsm");
@@ -29,7 +31,9 @@ function getSiteBlockedErrorDetails(docShell) {
2931
.finalize();
3032
}
3133

34+
let triggeringPrincipal = docShell.failedChannel.loadInfo ? Utils.serializePrincipal(docShell.failedChannel.loadInfo.triggeringPrincipal) : null;
3235
blockedInfo = { list: classifiedChannel.matchedList,
36+
triggeringPrincipal,
3337
provider: classifiedChannel.matchedProvider,
3438
uri: reportUri.asciiSpec };
3539
}

‎browser/base/content/browser.js

Lines changed: 35 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,6 +1009,18 @@ function handleUriInChrome(aBrowser, aUri) {
10091009
return false;
10101010
}
10111011

1012+
/* Creates a null principal using the userContextId
1013+
from the current selected tab or a passed in tab argument */
1014+
function _createNullPrincipalFromTabUserContextId(tab = gBrowser.selectedTab) {
1015+
let userContextId;
1016+
if (tab.hasAttribute("usercontextid")) {
1017+
userContextId = tab.getAttribute("usercontextid");
1018+
}
1019+
return Services.scriptSecurityManager.createNullPrincipal({
1020+
userContextId,
1021+
});
1022+
}
1023+
10121024
// A shared function used by both remote and non-remote browser XBL bindings to
10131025
// load a URI or redirect it to the correct process.
10141026
function _loadURI(browser, uri, params = {}) {
@@ -1031,6 +1043,10 @@ function _loadURI(browser, uri, params = {}) {
10311043
userContextId,
10321044
} = params || {};
10331045

1046+
if (!triggeringPrincipal) {
1047+
throw new Error("Must load with a triggering Principal");
1048+
}
1049+
10341050
let {
10351051
uriObject,
10361052
requiredRemoteType,
@@ -2399,6 +2415,10 @@ function BrowserTryToCloseWindow() {
23992415
function loadURI(uri, referrer, postData, allowThirdPartyFixup, referrerPolicy,
24002416
userContextId, originPrincipal, forceAboutBlankViewerInCurrent,
24012417
triggeringPrincipal, allowInheritPrincipal = false) {
2418+
if (!triggeringPrincipal) {
2419+
throw new Error("Must load with a triggering Principal");
2420+
}
2421+
24022422
try {
24032423
openLinkIn(uri, "current",
24042424
{ referrerURI: referrer,
@@ -3140,10 +3160,12 @@ var BrowserOnClick = {
31403160
},
31413161

31423162
ignoreWarningLink(reason, blockedInfo) {
3163+
let triggeringPrincipal = Utils.deserializePrincipal(blockedInfo.triggeringPrincipal) || _createNullPrincipalFromTabUserContextId();
31433164
// Allow users to override and continue through to the site,
31443165
// but add a notify bar as a reminder, so that they don't lose
31453166
// track after, e.g., tab switching.
31463167
gBrowser.loadURI(gBrowser.currentURI.spec, {
3168+
triggeringPrincipal,
31473169
flags: Ci.nsIWebNavigation.LOAD_FLAGS_BYPASS_CLASSIFIER,
31483170
});
31493171

@@ -3208,7 +3230,9 @@ var BrowserOnClick = {
32083230
* when their own homepage is infected, we can get them somewhere safe.
32093231
*/
32103232
function getMeOutOfHere() {
3211-
gBrowser.loadURI(getDefaultHomePage());
3233+
gBrowser.loadURI(getDefaultHomePage(), {
3234+
triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(), // Also needs to load homepage
3235+
});
32123236
}
32133237

32143238
/**
@@ -3224,7 +3248,9 @@ function goBackFromErrorPage() {
32243248
if (state.index == 1) {
32253249
// If the unsafe page is the first or the only one in history, go to the
32263250
// start page.
3227-
gBrowser.loadURI(getDefaultHomePage());
3251+
gBrowser.loadURI(getDefaultHomePage(), {
3252+
triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(),
3253+
});
32283254
} else {
32293255
BrowserBack();
32303256
}
@@ -3260,7 +3286,10 @@ function BrowserReloadWithFlags(reloadFlags) {
32603286
// If the remoteness has changed, the new browser doesn't have any
32613287
// information of what was loaded before, so we need to load the previous
32623288
// URL again.
3263-
gBrowser.loadURI(url, { flags: reloadFlags });
3289+
gBrowser.loadURI(url, {
3290+
flags: reloadFlags,
3291+
triggeringPrincipal: gBrowser.selectedBrowser.contentPrincipal,
3292+
});
32643293
return;
32653294
}
32663295

@@ -7666,7 +7695,9 @@ function switchToTabHavingURI(aURI, aOpenNew, aOpenParams = {}) {
76667695
}
76677696

76687697
if (ignoreFragment == "whenComparingAndReplace" || replaceQueryString) {
7669-
browser.loadURI(aURI.spec);
7698+
browser.loadURI(aURI.spec, {
7699+
triggeringPrincipal: aOpenParams.triggeringPrincipal || _createNullPrincipalFromTabUserContextId(),
7700+
});
76707701
}
76717702

76727703
if (!doAdopt) {

‎browser/base/content/tabbrowser.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1792,7 +1792,9 @@ window._gBrowser = {
17921792
browser.webProgress;
17931793
}
17941794

1795-
browser.loadURI(BROWSER_NEW_TAB_URL);
1795+
browser.loadURI(BROWSER_NEW_TAB_URL, {
1796+
triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(),
1797+
});
17961798
browser.docShellIsActive = false;
17971799
browser._urlbarFocused = true;
17981800

‎browser/components/extensions/parent/ext-browser.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,7 @@ global.replaceUrlInTab = (gBrowser, tab, url) => {
124124
let loaded = waitForTabLoaded(tab, url);
125125
gBrowser.loadURI(url, {
126126
flags: Ci.nsIWebNavigation.LOAD_FLAGS_REPLACE_HISTORY,
127+
triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(), // This is safe from this functions usage however it would be preferred not to dot his.
127128
});
128129
return loaded;
129130
};

‎browser/components/newtab/lib/SnippetsFeed.jsm

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,9 @@ this.SnippetsFeed = class SnippetsFeed {
190190
async showFirefoxAccounts(browser) {
191191
const url = await FxAccounts.config.promiseSignUpURI("snippets");
192192
// We want to replace the current tab.
193-
browser.loadURI(url);
193+
browser.loadURI(url, {
194+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({}),
195+
});
194196
}
195197

196198
async onAction(action) {

‎browser/components/preferences/in-content/subdialogs.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,9 @@ SubDialog.prototype = {
159159
}
160160
};
161161
this._frame.addEventListener("load", onBlankLoad);
162-
this._frame.loadURI("about:blank");
162+
this._frame.loadURI("about:blank", {
163+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({}),
164+
});
163165
}, 0);
164166
},
165167

‎browser/components/preferences/in-content/sync.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,9 @@ var gSyncPane = {
358358
// Get the <browser> element hosting us.
359359
let browser = window.docShell.chromeEventHandler;
360360
// And tell it to load our URL.
361-
browser.loadURI(url);
361+
browser.loadURI(url, {
362+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({}),
363+
});
362364
},
363365

364366
async signIn() {

‎browser/components/sessionstore/SessionStore.jsm

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2960,7 +2960,11 @@ var SessionStoreInternal = {
29602960
// a flash of the about:tabcrashed page after selecting
29612961
// the revived tab.
29622962
aTab.removeAttribute("crashed");
2963-
browser.loadURI("about:blank");
2963+
browser.loadURI("about:blank", {
2964+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({
2965+
userContextId: aTab.userContextId,
2966+
}),
2967+
});
29642968

29652969
let data = TabState.collect(aTab, TAB_CUSTOM_VALUES.get(aTab));
29662970
this.restoreTab(aTab, data, {

‎browser/components/sessionstore/content/aboutSessionRestore.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,9 @@ function restoreSession() {
180180

181181
function startNewSession() {
182182
if (Services.prefs.getIntPref("browser.startup.page") == 0)
183-
getBrowserWindow().gBrowser.loadURI("about:blank");
183+
getBrowserWindow().gBrowser.loadURI("about:blank", {
184+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({}),
185+
});
184186
else
185187
getBrowserWindow().BrowserHome();
186188
}

‎browser/components/shell/HeadlessShell.jsm

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ ChromeUtils.import("resource://gre/modules/osfile.jsm");
1313
// before they are called.
1414
const progressListeners = new Map();
1515

16-
function loadContentWindow(webNavigation, uri) {
16+
function loadContentWindow(webNavigation, uri, principal) {
1717
return new Promise((resolve, reject) => {
18-
webNavigation.loadURI(uri, Ci.nsIWebNavigation.LOAD_FLAGS_NONE, null, null, null);
18+
webNavigation.loadURI(uri, Ci.nsIWebNavigation.LOAD_FLAGS_NONE, null, null, null, principal);
1919
let docShell = webNavigation.QueryInterface(Ci.nsIInterfaceRequestor)
2020
.getInterface(Ci.nsIDocShell);
2121
let webProgress = docShell.QueryInterface(Ci.nsIInterfaceRequestor)
@@ -50,7 +50,7 @@ async function takeScreenshot(fullWidth, fullHeight, contentWidth, contentHeight
5050
try {
5151
var windowlessBrowser = Services.appShell.createWindowlessBrowser(false);
5252
// nsIWindowlessBrowser inherits from nsIWebNavigation.
53-
let contentWindow = await loadContentWindow(windowlessBrowser, url);
53+
let contentWindow = await loadContentWindow(windowlessBrowser, url, Services.scriptSecurityManager.getSystemPrincipal());
5454
contentWindow.resizeTo(contentWidth, contentHeight);
5555

5656
let canvas = contentWindow.document.createElementNS("http://www.w3.org/1999/xhtml", "html:canvas");

‎browser/components/uitour/UITour.jsm

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -468,7 +468,9 @@ var UITour = {
468468
}
469469

470470
// We want to replace the current tab.
471-
browser.loadURI(url.href);
471+
browser.loadURI(url.href, {
472+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({}),
473+
});
472474
});
473475
break;
474476
}
@@ -483,7 +485,9 @@ var UITour = {
483485
}
484486

485487
// We want to replace the current tab.
486-
browser.loadURI(url.href);
488+
browser.loadURI(url.href, {
489+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({}),
490+
});
487491
});
488492
break;
489493
}

‎browser/modules/ContentSearch.jsm

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,9 @@ var ContentSearch = {
247247
this._reply(msg, "Blur");
248248
browser.loadURI(submission.uri.spec, {
249249
postData: submission.postData,
250+
triggeringPrincipal: Services.scriptSecurityManager.createNullPrincipal({
251+
userContextId: win.gBrowser.selectedBrowser.getAttribute("userContextId"),
252+
}),
250253
});
251254
} else {
252255
let params = {

0 commit comments

Comments
 (0)