Closed Bug 1443073 Opened 7 years ago Closed 7 years ago

extensions can inject script into addons.mozilla.org by modifying requests to www.google-analytics.com

Categories

(WebExtensions :: General, enhancement)

Product:
WebExtensions
Component:
General
Type:
enhancement
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED INVALID

People

(Reporter: pauljt, Unassigned)

References

Details

(Keywords: sec-high)

In 1415644 we are prohibiting access for extensions to mess with this domain, but adding a domain blacklist. But we include google analytics on addons.mozilla.org, so an extension could inject script by modifying the response. Looks like 1415644 is close to landing, so I'm filing this as a follow-up.
Group: core-security → toolkit-core-security
Shane can you take a look? This shouldn't work since the request originates from a domain that we block (AMO)
Flags: needinfo?(mixedpuppy)
Paul, was this something verified as possible to do? At least with Bug 1415644 is shouldn't be, we check the loading principal against the blacklist. https://searchfox.org/mozilla-central/source/toolkit/components/extensions/webrequest/ChannelWrapper.cpp#378
Flags: needinfo?(mixedpuppy) → needinfo?(ptheriault)
Yep this bug was me misunderstanding what the change in 1415644 does. (see my comment here https://bugzilla.mozilla.org/show_bug.cgi?id=1415644#c64 )
Status: NEW → RESOLVED
Closed: 7 years ago
Flags: needinfo?(ptheriault)
Resolution: --- → INVALID
Product: Toolkit → WebExtensions
Group: toolkit-core-security
Depends on: 1664513
No longer depends on: 1664513
You need to log in before you can comment on or make changes to this bug.