1274567 - Use DOMWindowCreated instead DOMContentLoaded to propagate the userContextId from content to parent process

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Andrea Marchesini [:baku]]

Attachment: signal.patch

Comment 1

[Olli Pettay [:smaug][[e-mail]](vacation until July 14)]

Comment on attachment 8754818 [details] [diff] [review]
signal.patch

So this is probably fine, but it isn't clear to me why we need to wait for anything here. Why can't you access
content.document.nodePrincipal.originAttributes.userContextId; synchronously when the script is executed?

Comment 2

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/207d989869ec

Comment 3

[Andrea Marchesini [:baku]]

I don't remember why we have this setup. Mike, can you help me answering this smaug's question?

Comment 4

[Andrea Marchesini [:baku]]

Attachment: names.patch

Comment 5

[Olli Pettay [:smaug][[e-mail]](vacation until July 14)]

Btw, one case to test is something like

var w = window.open(); // no params
w.document.body.innerHTML = "hello world";

Comment 6

[Andrea Marchesini [:baku]]

Attachment: test.patch

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c2bfa8578aac

Comment 8

[Olli Pettay [:smaug][[e-mail]](vacation until July 14)]

Comment on attachment 8755296 [details] [diff] [review]
test.patch

I'm pretty sure this is missing a file ;)

Comment 9

[Andrea Marchesini [:baku]]

Attachment: test.patch

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/207d989869ec
https://hg.mozilla.org/mozilla-central/rev/c2bfa8578aac

Comment 11

[Mike Conley (:mconley) (:⚙️)]

smaug has a good point. I'm not certain we add any value by waiting for either DOMContentLoaded or DOMWindowCreated - if anything, we just make the code more complicated.

What happens if you just read the value when the script is loaded?

Comment 12

[Andrea Marchesini [:baku]]

Yes, it works. I'll file a separate bug for this.