1308951 - Add a pref to whitelist specific domains as SecureContexts

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Richard Barnes [:rbarnes]]

One of the objections to restricting APIs to secure contexts (cf. Bug 1177957) is that this makes it difficult to run small experiments, since you need to get a certificate for the website hosting the experiment.   While the industry has made progress in making it easier to get certificates, I'm willing to concede that this can still be a barrier for some folks.

To remove this barrier, we should consider adding a pref that allows users to whitelist certain domains as secure contexts.  Specifically, for domains in the whitelist, we would consider an origin as potentially trustworthy [1] if the hostname in the origin is in the whitelist, regardless of the scheme or port.

For example, if the preference contains "example.com,example.net", then the origins "http://example.com:8090" would be considered potentially trustworthy.

[1] https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy

Comment 1

[Richard Barnes [:rbarnes]]

Attachment: Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

Review commit: https://reviewboard.mozilla.org/r/84618/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/84618/

Comment 2

[J.C. Jones [:jcj] (he/him)]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

https://reviewboard.mozilla.org/r/84618/#review83210

I'd recommend getting a second opinion than mine that this isn't dangerous in some non-obvious way before landing, but from every angle I look at it, it looks fine.

::: dom/security/test/unit/test_isOriginPotentiallyTrustworthy.js:22
(Diff revision 1)
>  
>  XPCOMUtils.defineLazyServiceGetter(this, "gContentSecurityManager",
>                                     "@mozilla.org/contentsecuritymanager;1",
>                                     "nsIContentSecurityManager");
>  
> +var prefs = Cc["@mozilla.org/preferences-service;1"].getService(Ci.nsIPrefBranch);

We should also test the case of the whitelist containing non-network resources, to catch that branch.

Comment 3

[Richard Barnes [:rbarnes]]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/84618/diff/1-2/

Comment 4

[Richard Barnes [:rbarnes]]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

https://reviewboard.mozilla.org/r/84618/#review83210

> We should also test the case of the whitelist containing non-network resources, to catch that branch.

- Added a test based on a "chrome://" URL
- Changed one of the whitelisted URLs to a "ws://" URL
- Added tests for the remaining whitelisted schemes

Comment 5

[Richard Barnes [:rbarnes]]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

https://reviewboard.mozilla.org/r/84618/#review83210

Added :ckerschb

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

https://reviewboard.mozilla.org/r/84618/#review83246

looks good, r=me

::: dom/security/nsContentSecurityManager.cpp:681
(Diff revision 2)
> +  // check to see if it has been whitelisted by the user.  We only apply this
> +  // whitelist for network resources, i.e., those with scheme "http" or "ws".
> +  // The pref should contain a comma-separated list of hostnames.
> +  bool networkResource = scheme.EqualsLiteral("http") || scheme.EqualsLiteral("ws");
> +  nsAdoptingCString whitelist = Preferences::GetCString("dom.securecontext.whitelist");
> +  if (networkResource && whitelist) {

performance nit: would it make sense to only query the whitelist in case we are evaluting a scheme of http or ws? In other words. Would it make sense to do:

if ("http" || "ws") {
  if (whitelist) {
   ...
  }
}

I would imagine that quering the whitelist is rather slow and we could avoid doing it if not necessarily needed.

Comment 7

[Richard Barnes [:rbarnes]]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/84618/diff/2-3/

Comment 8

[Richard Barnes [:rbarnes]]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

https://reviewboard.mozilla.org/r/84618/#review83258

Comment 9

[Richard Barnes [:rbarnes]]

Comment on attachment 8799441 [details]
Bug 1308951 - Add a pref to whitelist specific domains as SecureContexts

https://reviewboard.mozilla.org/r/84618/#review83260

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cfb9de0c9f2a
Add a pref to whitelist specific domains as SecureContexts r=ckerschb,jcj

Comment 11

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/cfb9de0c9f2a