Open Bug 1490131 Opened 6 years ago Updated 2 years ago

PWebSocket accepts principals from the content process without verification

Categories

(Core :: Networking: WebSockets, defect, P3)

Product:
Core
Component:
Networking: WebSockets
Type:
defect

Tracking

()

Project Flags:
Fission Milestone Future

People

(Reporter: tjr, Unassigned)

References

(Depends on 1 open bug, Blocks 1 open bug)

Details

(Whiteboard: [necko-triaged])

In https://searchfox.org/mozilla-central/source/netwerk/protocol/websocket/PWebSocket.ipdl the AsyncOpen call takes a parameter OptionalLoadInfoArgs aLoadInfoArgs which eventually flows into a channel. This allows a Content Process to directly control the Principal and other information in a channel. I haven't been able to directly figure out the implications for this, but it seems likely that the Parent Process should at least assert that the Principals provided by the Content Process are permittable by that Content Process.
Depends on: fission-ipc-map
Priority: -- → P3
Whiteboard: [necko-triaged]

This bug is not a Fission MVP blocker.

Fission Milestone: --- → Future
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.