Closed Bug 1388889 Opened 6 years ago Closed 6 years ago

sandboxed requests are not viewable in webrequest to do origin check

Categories

(WebExtensions :: Request Handling, enhancement, P1)

Product:
WebExtensions
Component:
Request Handling
Version:
49 Branch
Type:
enhancement

Tracking

(firefox57 fixed)

Status:
RESOLVED FIXED
Milestone:
mozilla57
Tracking Flags:
Tracking Status
firefox57 --- fixed

People

(Reporter: mixedpuppy, Assigned: mixedpuppy)

Details

Attachments

(1 file, 1 obsolete file)

Bug 1388889 fix null principal handling for webrequest,
59 bytes, text/x-review-board-request
kmag
: review+
Details 
The origin check in ext-webrequest prevents viewing sandboxed requests due to origin being moz-nullprincipal.  Ad blockers need to be able to see these requests.
Also, if the test lands with bug 1305237, it [test_ext_webrequest_frameId.html] will need to be updated.
Attached patch failing test for sandbox request (obsolete) — — Splinter Review 
for later.
Attachment #8895560 - Attachment is obsolete: true
Comment on attachment 8895603 [details]
Bug 1388889 fix null principal handling for webrequest,

https://reviewboard.mozilla.org/r/166814/#review172992

::: toolkit/components/extensions/ext-webRequest.js:34
(Diff revision 1)
>          return;
>        }
>        // and the origin that is loading the resource.
>        const origin = data.documentUrl;
>        const own = origin && origin.startsWith(context.extension.getURL());
> -      if (origin && !own && !hosts.matches(Services.io.newURI(origin))) {
> +      const nullPrincipal = origin && origin.startsWith("moz-nullprincipal:");

We should check `principal.isNullPrincipal` here. `moz-nullprincipal:` origins are an unreliable implementation detail.
Attachment #8895603 - Flags: review?(kmaglione+bmo)
Comment on attachment 8895603 [details]
Bug 1388889 fix null principal handling for webrequest,

https://reviewboard.mozilla.org/r/166814/#review175518
Attachment #8895603 - Flags: review?(kmaglione+bmo) → review+
Depends on: 1305237
See Also: 1305237 → 
Slightly reworked the test patch to loose the dependency.
No longer depends on: 1305237
Pushed by mixedpuppy@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/59352665f357
fix null principal handling for webrequest, r=kmag
https://hg.mozilla.org/mozilla-central/rev/59352665f357
Status: NEW → RESOLVED
Closed: 6 years ago
status-firefox57: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla57
Product: Toolkit → WebExtensions
You need to log in before you can comment on or make changes to this bug.