1326260 - Consider about:debugging client code to be in a child process

Status: NEW

(DevTools :: about:debugging, defect, P3)

Description

[Jonathan Kingston [:jkt] he/him]

I noticed when working on: https://reviewboard.mozilla.org/r/100720/diff/3#index_header for 1325505

I had to make a Handler for child to parent process because about:serviceworkers is loaded in child. (http://searchfox.org/mozilla-central/source/docshell/base/nsAboutRedirector.cpp#110)

However this wasn't needed for about:debugging I directly injected the jsm module. Which means that all the code including the client side of the client/server relationship is running in parent process.

Code such as: devtools/client/aboutdebugging/components/workers/service-worker-target.js is running in client despite the code separated into server vs client relationship.

This means all of the react code in about:debugging is running in a privileged context.

This is more of a query, sorry for triggering a security bug. However I thought it was good to check this way.

Comment 1

[:Gijs (he/him)]

I don't think this needs to be sec-sensitive. We still have chrome-privileged code in content processes (those two things are orthogonal), though it might be decent defense-in-depth to move more stuff to the child and/or separate processes, on the other hand, if we then have to open up APIs via IPC that shouldn't be open that way, that might be less fun.

Comment 2

[Julian Descottes [:jdescottes]]

Aboutdebugging triage. Filter on TRIAGE-JD201705