1490124 - Predictor Engine can be primed by rogue Content Process

Status: NEW

(Core :: Networking, enhancement, P3)

Description

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

In https://searchfox.org/mozilla-central/source/netwerk/ipc/PNecko.ipdl the child child provides URIs and originAttributes to the Parent Process in PredPredict and PredLearn which are then fed into the Predictor Engine without being validated.

A rogue Content Process could like about these values and cause predictor entries to be stored for the wrong OA or cache key, which can cause user identities to be linked across Containers/FPI. I haven't fully explored the implications of this, it's possible other bad things could happen.

We should double check the supplied values from the content process and validate that the values are allowed by the Content Process that supplied them.

Comment 1

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

SpeculativeConnect too

Comment 2

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

HTMLDNSPrefetch & CancelHTMLDNSPrefetch I believe also.

Comment 3

[Chris Peterson [:cpeterson]]

This bug is not a Fission MVP blocker.