162589 - about:cache-entry should not be sent as a HTTP Referer header.

Status: VERIFIED FIXED

(Core :: Networking: Cache, defect, P1)

Description

[Darin Fisher]

1) load about:cache
2) click on a http page that is cached
3) notice that you're looking at an about:cache-entry URL that has the original
http or https URL encoded in it.
4) click on the link, and the about:cache-entry URL will be sent as the HTTP
Referer header.

this is a security concern when the cached URL is a HTTPS redirect to a HTTP
site.  normally, we don't expose HTTPS URLS to HTTP sites (or other HTTPS sites
for that matter).  however, because the HTTPS URL is encoded in a
about:cache-entry URL, our checks to prevent sending a HTTPS URL as a HTTP
Referer would fail.

Comment 1

[Bradley Baetz (:bbaetz)]

So we should just add 'about' to the list in nsHTTPChannel? Maybe we're better
off with a white list (http, https (sometimes), ftp, gopher) instead of the
blacklist....

Comment 2

[georgi - hopefully not receiving bugspam]

I agree that white list is much better than black list.

Comment 3

[Darin Fisher]

yeah, a whitelist would make a lot more sense.

ultimately, however, i was thinking that each nsIProtocolHandler should be able
to tell us if it would allow URLs of its type to be sent as a HTTP referrer, but
maybe it really should be the HTTP implementation that decides.  hmm.  anyways,
a whitelist would be really easy to implement and it'd keep all of the decisions
about HTTP referrers in one place.

Comment 4

[Bradley Baetz (:bbaetz)]

Well, we could use another one of the flag bits, although last time I suggested
adding a flag to a frozen interface even if 'things' without the flag behaved as
before, I got a somewhat mixed reaction... We could try again now that we have a
contcrete example to discuss on npm.xpcom, I suppose.

Comment 5

[Darin Fisher]

i'm going to go with the white-list approach for now, and let such a discussion
go on in parallel... i think it's important to have a quick fix to this bug.

Comment 6

[Darin Fisher]

Attachment: v1 patch

simple whitelist for http referrer: only allows http, https, and ftp.  https
still follows the same referrer rules.	tested against about:cache-entry, and
verified that it is no longer sent as a referrer.

Comment 7

[Darin Fisher]

Attachment: v1.1 patch - forgot about gopher

Comment 8

[Bradley Baetz (:bbaetz)]

Comment on attachment 96782 [details] [diff] [review]
v1.1 patch - forgot about gopher

gopher forever!

r=bbaetz

Comment 9

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Comment on attachment 96782 [details] [diff] [review]
v1.1 patch - forgot about gopher

sr=heikki

Comment 10

[Darin Fisher]

fixed-on-trunk

Comment 11

[Tom Everingham]

verified trunk 09/05/02 - about:cache is not being sent as referer - winNT,
linux, mac

Comment 12

[Mitchell Stoltz (not reading bugmail)]

adding [e-mail] to CC list