1273687 - Consider whether/when XPConnect sandboxes should be able to see [SecureContext] API

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Jonathan Watt [:jwatt]]

Follow-up from bug 1177957 comment 23/30.

We should decide what to do about giving XPConnect sandboxes access to [SecureContext] API.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Per email discussion, we should have sandboxes inited with a window inherit its secure context state.  Ones inited with a URL or principal, presumably we would not treat as secure contexts, or we could just base it on that url or principal codebase, right?

Comment 2

[Andrew Overholt [:overholt]]

Is jwatt going to make the call here?

Comment 3

[Jonathan Watt [:jwatt]]

The email discussions bz refers to were between bholley, bz and myself. The recommendations from bholley were:

* Xray caller should see the secure APIs if either
  (a) they are system principal, or 
  (b) the Xrayed global sees the APIs.

* We should add a sandbox option, defaulting to false,
  for exposing secure-context APIs.

* IIUC the secure-context-ness can only be deduced from the
  Window, not the Principal, right? Assuming that's the case, I
  agree that the slightly-odd behavior of inheriting
  secure-context-ness when creating a sandbox from a
  Window-as-nsIScriptObjectPrincipal is the way to go.

I agree that we should have sandboxes inited with a window inherit its secure context state. I don't think we can really have sandboxes initialized with a URL or principal be a secure context though, since as bholley notes in that case we don't have enough information to make that call.

Comment 4

[Tim Taubert [:ttaubert] (inactive)]

Jonathan, I'm hitting test failures in bug 1333140 because it turns out that "crypto.subtle" is currently exposed to sandboxes, and even used by at least the Push service. What needs to be done here to move this forward? Do we "simply" need someone to implement what's suggested in comment #3?

Comment 5

[Jonathan Watt [:jwatt]]

I think so, yes. Maybe reach out to the XPConnect peers to see if one of them can take a look?

https://wiki.mozilla.org/Modules/All#XPConnect

Comment 6

[Jonathan Watt [:jwatt]]

Oops, didn't actually mean to needinfo bz. Probably best to find someone less busy if possible. :)

Comment 7

[Boris Zbarsky [:bzbarsky]]

Fwiw, the plan from comment 3 seems reasonable to me.  We just need someone to implement.

Comment 8

[Jonathan Kingston [:jkt] he/him]

I added the change into the patch for Bug 1333140 however we might want to separate it out here.

Comment 9

[Boris Zbarsky [:bzbarsky]]

It's probably better to factor out the fix for this bug and land it here, not in bug 1333140.

Comment 10

[Jonathan Kingston [:jkt] he/him]

Attachment: Bug 1273687 - Add isSecureContext to xpconnect sandboxes

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6d51893bde02
Add isSecureContext to xpconnect sandboxes r=bholley

Comment 12

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/6d51893bde02