1423406 - Use the content process sandbox to enforce the same-origin policy

Status: RESOLVED DUPLICATE of bug 1432593

(Core :: Security: Process Sandboxing, defect, P3)

Description

[demiobenour]

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.89 Safari/537.36

Steps to reproduce:

N/A


Actual results:

The same-origin policy is enforced by logic in the content processes.  As a result, a remote code execution exploit such as https://blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing/ allows for spoofing any action, on any website, using the user’s credentials.  For example, if the user is logged into online banking, or has their password saved within Firefox, the malware can cause an unauthorized funds transfer.


Expected results:

The same-origin policy should be enforced by the sandbox.  The content processes should not be able to violate it, even in the event of an arbitrary code execution exploit within one of them.

Comment 1

[Alex Gaynor [:Alex_Gaynor]]

Similar effort from Chrome: https://www.chromium.org/developers/design-documents/site-isolation

Comment 2

[Bob Owen (:bobowen)]

Strictly speaking, I don't think the process sandbox can enforce the same-origin policy.
It's more about helping to prevent exploitation and then restricting what an exploited process can do, which won't include what origins are accessible.

It will be Gecko code in the parent that has to enforce things, I'm not sure trying to make that theoretically part of the sandbox helps.

Comment 3

[Alex Gaynor [:Alex_Gaynor]]

Indeed, it's the process allocation and IPC handlers which would really be the enforcement mechanisms here.

Comment 4

[Gian-Carlo Pascutto [:gcp]]

A mini version of this (that has more chance of shipping in the near future) would be bug 1422049.