1388889 - sandboxed requests are not viewable in webrequest to do origin check

Status: RESOLVED FIXED

(WebExtensions :: Request Handling, enhancement, P1)

Description

[Shane Caraveo (:mixedpuppy)]

The origin check in ext-webrequest prevents viewing sandboxed requests due to origin being moz-nullprincipal.  Ad blockers need to be able to see these requests.

Comment 1

[Shane Caraveo (:mixedpuppy)]

Also, if the test lands with bug 1305237, it [test_ext_webrequest_frameId.html] will need to be updated.

Comment 2

[Shane Caraveo (:mixedpuppy)]

Attachment: failing test for sandbox request

for later.

Comment 3

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1388889 fix null principal handling for webrequest,

Review commit: https://reviewboard.mozilla.org/r/166814/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/166814/

Comment 4

[Kris Maglione [:kmag]]

Comment on attachment 8895603 [details]
Bug 1388889 fix null principal handling for webrequest,

https://reviewboard.mozilla.org/r/166814/#review172992

::: toolkit/components/extensions/ext-webRequest.js:34
(Diff revision 1)
>          return;
>        }
>        // and the origin that is loading the resource.
>        const origin = data.documentUrl;
>        const own = origin && origin.startsWith(context.extension.getURL());
> -      if (origin && !own && !hosts.matches(Services.io.newURI(origin))) {
> +      const nullPrincipal = origin && origin.startsWith("moz-nullprincipal:");

We should check `principal.isNullPrincipal` here. `moz-nullprincipal:` origins are an unreliable implementation detail.

Comment 5

[Shane Caraveo (:mixedpuppy)]

Comment on attachment 8895603 [details]
Bug 1388889 fix null principal handling for webrequest,

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/166814/diff/1-2/

Comment 6

[Kris Maglione [:kmag]]

Comment on attachment 8895603 [details]
Bug 1388889 fix null principal handling for webrequest,

https://reviewboard.mozilla.org/r/166814/#review175518

Comment 7

[Shane Caraveo (:mixedpuppy)]

Comment on attachment 8895603 [details]
Bug 1388889 fix null principal handling for webrequest,

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/166814/diff/2-3/

Comment 8

[Shane Caraveo (:mixedpuppy)]

Comment on attachment 8895603 [details]
Bug 1388889 fix null principal handling for webrequest,

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/166814/diff/3-4/

Comment 9

[Shane Caraveo (:mixedpuppy)]

Slightly reworked the test patch to loose the dependency.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/59352665f357
fix null principal handling for webrequest, r=kmag

Comment 11

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/59352665f357