1490049 - The URL field of a StorageEvent can be forged by a rogue content process

Status: NEW

(Core :: Storage: localStorage & sessionStorage, enhancement, P5)

Description

[Tom Ritter [:tjr]]

A storage event has a URL argument specifying 'The URL of the document whose key changed.': https://developer.mozilla.org/en-US/docs/Web/API/StorageEvent

When a StorageEvent occurs, we follow the flow in https://searchfox.org/mozilla-central/source/dom/storage/PBackgroundLocalStorageCache.ipdl of calling Notify on the Parent, and the Parent calls Observe on all the appropriate children.

The Parent correctly propagates all relevant security information via PrincipalInfo and privateBrowsingId. The URL (documentURI) is strictly used for the StorageEvent object and not used in any code.

However, it may be forged to be any value (including a different domain) by a rogue content process. If future code used the URL for security checks, it could be tricked.

I'd recommend verifying that the URL is a permissible value according to the PrincipalInfo that is retrieved in the RecvNotify function.  This is low priority.

Comment 1

[Chris Peterson [:cpeterson]]

This bug is not a Fission MVP blocker.