fix up the shumway use of createCodebasePrincipal to be aware of user context origin attributes

RESOLVED INCOMPLETE

Status

defect
RESOLVED INCOMPLETE
3 years ago
3 years ago

People

(Reporter: huseby, Unassigned)

Tracking

(Depends on 1 bug)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [shumway][OA])

(Reporter)

Description

3 years ago
In shumway's special storage it will need to make sure that it does proper user context isolation by setting the correct user context id in the origin attributes used when calling createCodebasePrincipal.

> browser/extensions/shumway/chrome/SpecialStorage.jsm
>   line 27
>     var principal = ssm.createCodebasePrincipal(uri, {});
(Reporter)

Comment 1

3 years ago
IMHO, this is not a blocker fixup for v1 of containers, but it should be considered a blocker for shipping shumway.  Without proper user context isolation, any storage done on behalf of a flash movie won't be properly isolated and shumway could be used as a cross-domain/cross-tab communication channel.
(Reporter)

Updated

3 years ago
Whiteboard: [shumway]
(Reporter)

Comment 2

3 years ago
Chris, are you the PM on shumway?  This bug is a blocker for shipping shumway and I want to make sure the shumway team is tracking it.
Flags: needinfo?(cpeterson)
Thanks. I've updated the Shumway bug dependencies. Shumway will need createCodebasePrincipal bug 1218479, but the Shumway work should not block you.
Blocks: shumway-1.0
No longer blocks: createCodebasePrincipal
Flags: needinfo?(cpeterson)
(Reporter)

Comment 4

3 years ago
After fixing up a bunch of other similar cases, I think the right thing to do here is to query the document/docshell for the origin attributes and using that.  Shumway should be isolating based on user context id.
Product: Firefox → Firefox Graveyard
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → INCOMPLETE
Why is this resolved incomplete?
Flags: needinfo?(ehumphries)
(Reporter)

Comment 7

3 years ago
The github issue is here: https://github.com/mozilla/shumway/issues/2418
(Reporter)

Updated

3 years ago
Whiteboard: [shumway] → [shumway][OA]
You need to log in before you can comment on or make changes to this bug.