Open Bug 1495835 Opened 6 years ago Updated 2 years ago

PBroadcastChannel can be constructed by a Rogue Content Process with a fraudulent origin

Categories

(Core :: DOM: Core & HTML, enhancement, P3)

Product:
Core
Component:
DOM: Core & HTML
Type:
enhancement

Tracking

()

Project Flags:
Fission Milestone Future

People

(Reporter: tjr, Unassigned)

References

(Depends on 1 open bug, Blocks 1 open bug)

Details

In PBackground.ipdl, PBroadcastChannel accepts a principal and an origin, and uses it to construct an actor which contains the origin as the lookup key.

It uses a CheckPrincipalRunnable to verify that the principal supplied matches the origin specified, but a rogue content process could supply a fraudulent pincipal to match the fraudulent origin to pass the check. After this, the content process could receive or send broadcast messages for other origins.

The supplied principal should be checked to ensure that the supplied data is valid for this content process.
Priority: -- → P3
Component: DOM → DOM: Core & HTML

This bug is not a Fission MVP blocker.

Fission Milestone: --- → Future
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.