1508355 - Add a test to make sure "Save Page As" respect First-Party Isolation

Status: RESOLVED FIXED

(Firefox :: Menus, enhancement, P5)

Description

[Arthur Edelstein [:arthur]]

In Tor Browser, we introduced a patch to isolate a number of "Saving" options by first-party. Namely:

* File menu:
  - Save Page As
* Context menu in content pages:
  - Save Page As
  - Save Image As
  - Save Video As
  - Save Link As
  - Save Frame As
* Page Info "Media" Panel:
  - Save As

This involves ensuring the request channel has the correct principal (and OriginAttribute) so that we get proper stream isolation.

We'd like to propose uplifting this patch to Firefox.

Current Tor Browser patch:
https://torpat.ch/22343
Original Tor ticket:
https://trac.torproject.org/22343

Comment 1

[Tim Huang[:timhuang]]

I believe that all "Save ... As" has followed OAs after bug 1469916. But it still doesn't have a test case for them.

Comment 2

[Tim Huang[:timhuang]]

Attachment: Add a test case for assuring all "Save ... As" options honor the first party domain. r=baku,[e-mail]

This patch adds a test case which tests following "Save ... As" options:

* File menu:
  - Save Page As
* Context menu in content pages:
  - Save Page As
  - Save Image As
  - Save Video As
  - Save Link As
  - Save Frame As
* Page Info "Media" Panel:
  - Save As

It triggers the save process and checks if the OA of the saving channel
has the correct first party domain.

Comment 3

[Andrea Marchesini [:baku]]

Comment on attachment 9036290 [details] [diff] [review]
Add a test case for assuring all "Save ... As" options honor the first party domain. r=baku,[e-mail]

Review of attachment 9036290 [details] [diff] [review]:
-----------------------------------------------------------------

::: browser/components/originattributes/test/browser/browser_firstPartyIsolation_saveAs.js
@@ +62,5 @@
> +});
> +
> +function createTemporarySaveDirectory() {
> +  let saveDir = Services.dirsvc.get("TmpD", Ci.nsIFile);
> +  saveDir.append("testsavedir");

saveDir.creatUnique(Ci.nsIFile.DIRECTORY_TYPE, 0o755);

without checking the existence.

Comment 4

[richard (Tor Project)]

Comment on attachment 9036290 [details] [diff] [review]
Add a test case for assuring all "Save ... As" options honor the first party domain. r=baku,[e-mail]

Review of attachment 9036290 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good to me

Comment 5

[Tim Huang[:timhuang]]

Attachment: Add a test case for assuring all "Save ... As" options honor the first party domain. r=baku,[e-mail]

Addressing review comment.

Comment 6

[Tim Huang[:timhuang]]

Attachment: Add a test case for assuring all "Save ... As" options honor the first party domain. r=baku,[e-mail]

Fixing an issue which causes a test failure.

Comment 7

[Tim Huang[:timhuang]]

Try looks good.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=d754c4d8ac5eb0dfcb0641ee086274a453c4304d

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0f709682e4a0
Add a test case for assuring all "Save ... As" options honor the first party domain. r=baku,[e-mail]

Comment 9

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/0f709682e4a0