1435581 - Cross origin resource sharing

Status: VERIFIED WORKSFORME

(Firefox :: New Tab Page, defect)

Description

[Akalanka Ekanayake]

This urls take origin as null.here is my proof of concept. ( access control allow origin)

GET /5/Firefox/58.0.1/20180128191252/WINNT_x86_64-msvc/en-US/release/Windows_NT%206.2/default/default/ HTTP/1.1
Host: snippets.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
origin: null
Connection: close





POST /v4/links/activity-stream HTTP/1.1
Host: tiles.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: text/plain;charset=UTF-8
origin: null
Content-Length: 728
Connection: close

{"locale":"en-US","topic":"activity-stream","client_id":"862f3e27-857e-4d47-b90b-0d08d0d836bc","version":"58.0.1","release_channel":"release","addon_version":"2018.01.04.0062-4997c81d","user_prefs":59,"session_id":"{de530a8e-a6bd-47e0-9867-4c4653dfd227}","page":"about:newtab","session_duration":880,"action":"activity_stream_session","perf":{"load_trigger_type":"menu_plus_or_keyboard","is_preloaded":true,"is_prerendered":true,"topsites_icon_stats":{"screenshot_with_icon":0,"screenshot":2,"tippytop":3,"rich_icon":1,"no_image":0},"topsites_data_late_by_ms":113,"highlights_data_late_by_ms":151,"topsites_first_painted_ts":1517664139719.3655,"load_trigger_ts":1517710919217.7947,"visibility_event_rcvd_ts":1517710919546.8254}}

Comment 1

[Caglar Ulucenk [:cag]]

Thank you for the submission.

For the first instance (snippets.cdn.mozilla.net), it's a GET request and GET requests can already be made cross-origin; therefore allowing a star "*" or null origin is not a big deal in my opinion.

Re: the second instance :ulfr, are we worried about arbitrary data being posted from all origins (including file:// and data:// origins since null origin seems to be allowed) to the tiles service?

Comment 2

[Julien Vehent]

> Re: the second instance :ulfr, are we worried about arbitrary data being posted from all origins (including file:// and data:// origins since null origin seems to be allowed) to the tiles service?

I'm not quite sure. Nan: what does the "/v4/links/activity-stream" endpoint do, and are we concerned about cross-origin posts there?

Comment 3

[Nan Jiang [:nanj]]

(In reply to Julien Vehent [:ulfr] from comment #2)
> > Re: the second instance :ulfr, are we worried about arbitrary data being posted from all origins (including file:// and data:// origins since null origin seems to be allowed) to the tiles service?
> 
> I'm not quite sure. Nan: what does the "/v4/links/activity-stream" endpoint
> do, and are we concerned about cross-origin posts there?

That's the telemetry endpoint for Ping-centre, which is being used by Tiles, Activity Stream, Firefox Onboarding, and Firefox iOS. Hence, cross-origin posting is expected by design here.

Comment 4

[Julien Vehent]

Thanks Nan. Resolving this bug as working as expected.

Comment 5

[Akalanka Ekanayake]

Is it fixed?

Comment 6

[Akalanka Ekanayake]

Hi ,

snippets.cdn.mozilla.net issue is fixed.
tiles.services.mozilla.com issue is still working! what about that ?

Comment 7

[Nan Jiang [:nanj]]

(In reply to Unknown Per from comment #5)
> Is it fixed?

Hi, thanks for reporting this.

The cross origin posting is an expected behavior in this case, nothing to be fixed here.

Comment 8

[Daniel Veditz [:dveditz]]

If a server responds with "Access-Control-Allow-Origin: *" then the resource is intended to be public, and the browser will not use any returned data based on the user's cookies.