1456486 - Check the return value of ThirdPartyUtil::IsThirdParty*

Status: ASSIGNED

(Core :: DOM: Security, enhancement, P2)

Description

[François Marier [:francois]]

The channel classifier uses ThirdPartyUtil but doesn't check the return value:

https://searchfox.org/mozilla-central/rev/8f06c1b9a080b84435a2906e420fe102e1ed780b/netwerk/base/nsChannelClassifier.cpp#356-368

This potentially feeds bogus values into the rest of its checks.

We should check the return value in that function, as well as for all other callers of IsThirdPartyURI() and IsThirdPartyChannel().

Once all callers are doing the right thing, we should use the template/macro that enforces the use of the return value.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Hey Francois, you sure we shouldn't do that? We could have someone else look into it in case you are busy with other things. What do you think?

Comment 2

[François Marier [:francois]]

I do think we should do it. In fact, it's part of the anti-tracking plan, though it's not in a high-priority phase.

I'd say P2 is a good priority. I'm hoping Dimi can pick it up at some point (maybe Q4).