1163753 - See if we can remove the special case for resource:// workers needing the system principal

Status: NEW

(Core :: DOM: Workers, task, P5)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

See bug 1163109. We have a special case for resource:// workers loaded with the system principal where we give those workers the system principal so that they can do cross-site xhr. Maybe we don't need to do that any more?

Comment 1

[Andrew Sutherland [:asuth] (he/him)]

I doubt I have the full context, but content with the "systemXHR" permission can use the mozSystem non-standard option to XHR: https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest#Non-standard_properties

Comment 2

[Andrew McCreight [:mccr8]]

I'm marking this sec-other because it sounds like there's no known security issue with this code.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Jonas, what _is_ our exact security model for this stuff?  Our worker security model still doesn't make sense to me....

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I don't remember our rules for chrome workers. They are mostly there to make it harder for chrome code to XSS itself. I.e. it's there for similar reasons that we don't let data: URLs inherit chrome principals.

IIRC dveditz had stronger opinions than I did about what exact rules we should have.

Also, is there a reason we need to keep this bug closed?

Comment 5

[Boris Zbarsky [:bzbarsky]]

> Also, is there a reason we need to keep this bug closed?

I don't see one offhand.

Comment 6

[Jens Stutte [:jstutte]]

ScriptLoader.cpp seems to have changed heavily since bug 1163109 landed (I cannot identify any of that patch anymore). :smaug, as you were involved on the other bug back then, do you have a feeling if this bug here is still an issue?

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

https://searchfox.org/mozilla-central/rev/5c922d8b93b43c18bf65539bfc72a30f84989003/dom/workers/WorkerLoadInfo.cpp#211,218-219
But the behavior is maybe reasonable.