1356277 - Respect permissions ACCESS_ALLOW_FIRST_PARTY_ONLY and ACCESS_LIMIT_THIRD_PARTY in nsContentUtils::StorageAllowedFor

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement)

Description

[:Nika Layzell (ni? for response)]

In bug 1245595 comment 26, Ian noticed that sessionStorage (and other forms of storage) were being denied for first party pages, even when ACCESS_ALLOW_FIRST_PARTY_ONLY or ACCESS_LIMIT_THIRD_PARTY permissions were set for those pages.

This was because those permission options were being ignored by the storage allowed algorithm. This patch should change the algorithm to respect those permissions as overrides for the deny preference.

Comment 1

[:Nika Layzell (ni? for response)]

Attachment: Respect ALLOW_FIRST_PARTY_ONLY and LIMIT_THIRD_PARTY permissions in StorageAllowedFor*

MozReview-Commit-ID: 7TQSFk7EGmk

Comment 2

[:ehsan akhgari]

Comment on attachment 8858006 [details] [diff] [review]
Respect ALLOW_FIRST_PARTY_ONLY and LIMIT_THIRD_PARTY permissions in StorageAllowedFor*

Review of attachment 8858006 [details] [diff] [review]:
-----------------------------------------------------------------

Can you please add a test for this?  It seems bad that this wasn't caught by a test...

Comment 3

[:Nika Layzell (ni? for response)]

Attachment: Part 2: Add a test for LIMIT_THIRD_PARTY permission with sessionStorage

MozReview-Commit-ID: 6EI2eynexN0

Comment 4

[:ehsan akhgari]

Comment on attachment 8858099 [details] [diff] [review]
Part 2: Add a test for LIMIT_THIRD_PARTY permission with sessionStorage

Review of attachment 8858099 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c5acd8a8058c
Part 1: Respect ALLOW_FIRST_PARTY_ONLY and LIMIT_THIRD_PARTY permissions in StorageAllowedFor*, r=ehsan
https://hg.mozilla.org/integration/mozilla-inbound/rev/26376d7421da
Part 2: Add a test for LIMIT_THIRD_PARTY permission with sessionStorage, r=ehsan

Comment 6

[:Nika Layzell (ni? for response)]

I had to back this out because I didn't realize it failed some tests on try.

Comment 7

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/208114b8113e
backout due to failing test_localStorageSessionPrefOverride.html on try

Comment 8

[:Nika Layzell (ni? for response)]

Attachment: Part 3: Override both lifetimePolicy and behavior in all cookie permission branches

Permissions should fully override the default behavior from preferences for
lifetimePolicy and cookie behavior. This is consistent with the previous
behaviour from before this bug was implemented.

MozReview-Commit-ID: 9FfOrN6XV6q

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0a2fca8aa2e6
Part 1: Respect ALLOW_FIRST_PARTY_ONLY and LIMIT_THIRD_PARTY permissions in StorageAllowedFor*, r=ehsan
https://hg.mozilla.org/integration/mozilla-inbound/rev/10e9a5b8150c
Part 2: Add a test for LIMIT_THIRD_PARTY permission with sessionStorage, r=ehsan
https://hg.mozilla.org/integration/mozilla-inbound/rev/130a6cae4093
Part 3: Override both lifetimePolicy and behavior in all cookie permission branches, r=ehsan

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0a2fca8aa2e6
https://hg.mozilla.org/mozilla-central/rev/10e9a5b8150c
https://hg.mozilla.org/mozilla-central/rev/130a6cae4093