1372519 - Add origin check to FHR web implementation

Status: RESOLVED INCOMPLETE

(Firefox Health Report Graveyard :: Web: Health Report, enhancement, P3)

Description

[Georg Fritzsche [:gfritzsche]]

(In reply to April King [:April] in bug 1346273, comment #37)
> Yeah, about:healthreport has an origin check, but FHR doesn't:
> 
> https://github.com/mozilla/fhr-jelly/blob/master/js/data_v4.js#L357
> 
> I'm not sure this is an actual problem though -- I could frame FHR myself
> and possibly inject a message to cause an XSS, but I don't think I would be
> able to cause much issue other than perhaps spewing cookies on .mozilla.net.
> FHR doesn't really contain any data itself. And I can't iframe or
> window.open() about:healthreport, so I can't pass messages to FHR in a way
> that might percolate up to about:healthreport.
> 
> Overall it's a pretty small risk but an origin check (for "null", I believe)
> might be worth adding simply because it's one of (if not the only) part(s)
> of FHR that accepts arbitrary input.

Comment 1

[Firefox Bug Husbandry Bot]

See https://bugzilla.mozilla.org/show_bug.cgi?id=1497137; component deprecated.