1340694 - don't set fetch/xhr referrer based on exact nsIPrincipal URI value

Status: NEW

(Core :: DOM: Networking, defect, P3)

Description

[Ben Kelly [:bkelly, not reviewing]]

In nsContentUtils::SetFetchReferrerURIWithPolicy() we set the referrer based on the URI in the nsIPrincipal:

https://dxr.mozilla.org/mozilla-central/source/dom/base/nsContentUtils.cpp#8530

This is called when fetch/xhr are used from worker threads.

This is very fragile since its not obvious that the nsIPrincipal URI is significant here.  It would be much better to make these paths get the referrer from WorkerPrivate::GetResolvedScriptURI() or WorkerPrivate::ScriptURL().

https://dxr.mozilla.org/mozilla-central/source/dom/workers/WorkerPrivate.h#506

Comment 1

[Ben Kelly [:bkelly, not reviewing]]

Note, because of this issue we likely send the wrong referer header for blob: URL workers at the moment.  See:

https://github.com/w3c/webappsec-referrer-policy/issues/95

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

To clarify comment 1, a blob: URL worker currently ends up with a principal where the URL is the triggering document URL, not the blob URL.

Comment 3

[Sunil Mayya]

We need to confirm if this is still the case. 5 points for the investigation efforts, ranked low since this likely is fixed(?).