1151595 - mPrincipal is null when creating channel which updates ServiceWorker

Status: RESOLVED INVALID

(Core :: DOM: Security, defect)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1151595.patch

Nikhil, in Bug 1137419 you slightly changed the behavior for creating a channel which updates a ServiceWorker. I agree with your change to use mPrincipal [1] but unfortunately ServiceWorkerRegisterJob has two constructors, one of them not initializing mPrincipal (see patch) - which is going to cause problems once we are going to move security checks of channels into AsyncOpen (which is about to happen soon).

Anwyay, the patch is just to highlight the problem, if you can tell me how to succeed, e.g. what principal to use I am going to finish the patch up. I don't think systemPrincipal is the right principal to use, but it would be great to set some other principal in the constructor so we have a nice separation of principals within the two (Register, and Update) constructors and we don't have to find a principal shortly before creating the channel in Update().

[1] http://mxr.mozilla.org/mozilla-central/source/dom/workers/ServiceWorkerManager.cpp#750

Comment 2

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Comment on attachment 8588748 [details] [diff] [review]
bug_1151595.patch

Review of attachment 8588748 [details] [diff] [review]:
-----------------------------------------------------------------

This code is going away in Bug 931249, but for now you can change it to |mRegistration->mPrincipal| instead of mPrincipal. This is always guaranteed to be set.
You can also get rid of the appcodebase block. Thanks!

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Perfect - Bug 931249 landed this afternoon :-) which makes this bug invalid.