1476324 - Storage activation via window.open(URL) applies across top-level domains

Status: RESOLVED FIXED

(Firefox :: Security, enhancement)

Description

[Steven Englehardt [:englehardt]]

As part of the new cookie restrictions (Bug 1473978) we implemented a storage activation heuristic based on the use of window.open by the opening document (Bug 1474651). This heuristic is intended to allow storage access for the target of the window.open call only on the opening document's site. Instead, it appears to enable storage access for that third party on all first parties.

Steps to reproduce:

With a fresh profile, visit:

https://senglehardt.com/test/identity_providers/facebook.html

and

https://www.cs.princeton.edu/~ste/test/identity_providers/facebook.html

In both cases no cookies should be sent in requests to Facebook.

Click "Login In" on senglehardt.com.
Refresh the princeton.edu tab.

You should now see cookies sent to Facebook on the princeton.edu page.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: part 2 - tests

Comment 2

[Andrea Marchesini [:baku]]

Attachment: part 1 - window.open() from top-level

Comment 3

[Andrea Marchesini [:baku]]

Attachment: part 3 - annotate top-level channel

Currently we annotate only 3rd party channels. We must annotate also top-level channels because we need to grant the first party storage permission if a top-level non-tracking page does a window.open(tracker) and the user interacts with that tracker page.

Comment 4

[(no longer active)]

Comment on attachment 8992870 [details] [diff] [review]
part 3 - annotate top-level channel

Review of attachment 8992870 [details] [diff] [review]:
-----------------------------------------------------------------

Stealing!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/48dbdb55cabe
Storage activation via window.open(URL) applies across top-level domains - part 1 - window.open() from top-level, r=ehsan
https://hg.mozilla.org/integration/mozilla-inbound/rev/2272ac475d49
Storage activation via window.open(URL) applies across top-level domains - part 2 - tests, r=ehsan
https://hg.mozilla.org/integration/mozilla-inbound/rev/1b81fd5d2002
Storage activation via window.open(URL) applies across top-level domains - part 3 - annotate top-level channels, r=ehsan

Comment 6

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/48dbdb55cabe
https://hg.mozilla.org/mozilla-central/rev/2272ac475d49
https://hg.mozilla.org/mozilla-central/rev/1b81fd5d2002