1264574 - Isolate cache to URL bar domain (Tor 13742)

Status: RESOLVED DUPLICATE of bug 1260931

(Core :: DOM: Security, defect, P2)

Description

[Dave Huseby [:huseby]]

The Tor Patch for testing cache isolation.

Comment 1

[Dave Huseby [:huseby]]

Attachment: the Tor Browser patch (WIP)

Comment 2

[Honza Bambas (:mayhemer)]

This patch needs a good explanation of what you are doing.  Messing this way with the id extension will just blow all of the current cache and might break some functionality.

Comment 3

[Honza Bambas (:mayhemer)]

Comment on attachment 8741294 [details] [diff] [review]
the Tor Browser patch (WIP)

Review of attachment 8741294 [details] [diff] [review]:
-----------------------------------------------------------------

::: netwerk/protocol/http/nsHttpChannel.cpp
@@ +2775,4 @@
>      if (mLoadFlags & LOAD_BYPASS_LOCAL_CACHE_IF_BUSY)
>          cacheEntryOpenFlags |= nsICacheStorage::OPEN_BYPASS_IF_BUSY;
>  
> +    extension.Append(nsPrintfCString("%s@%d", cacheDomain.get(), mPostID));

personally, I would add the cacheDomain to the ext id (if that is even the best place to add it) only if it's different from the domain of the URL we are loading with this channel.  That way you won't blow currently single-domain cached stuff from the people's caches while the isolation will still work.

Also, mPostID must be added only when non-null.

Comment 4

[Honza Bambas (:mayhemer)]

Also, this should be optional IMO.  It will effectively disable cache for loads of some third-party hosted resources like jquery and fonts, which is IMO unfortunate and goes against the cache use.  I would engage this only when the channel is loaded as part of page where tracking protection is enabled (from the Firefox point of view) or with some other annotation flag that Tor browser can set.

Comment 5

[Arthur Edelstein [:arthur]]

Here's a link that tracks the Tor Browser patch as it is rebased.
https://torpat.ch/13742

Comment 6

[Jonathan Hao (inactive) [:jhao]]

The patch from Tor browser is implementation instead of testing, and we may not have to do extra thing once Yoshi's patch in bug 1260931 lands.  Cache testing is taken care of in bug 1264577.

Comment 7

[Ethan Tseng [:ethan]]

(In reply to Jonathan Hao [:jhao] from comment #6)
> The patch from Tor browser is implementation instead of testing, and we may
> not have to do extra thing once Yoshi's patch in bug 1260931 lands.  Cache
> testing is taken care of in bug 1264577.

Jonathan, thanks for this clarification information.
Tim, when you verified that the cache is really isolated in bug 1264577, please set this bug as WONTFIX.

Comment 8

[Dave Huseby [:huseby]]

Attachment: test case to validate http cache isolation.

this patch is a test cache that confirms that http/content cache isolation is working with first party origin isolation.  since it appears to be working, i'm going to close this bug as resolved, duplicate.