1501072 - PContentPermissionRequest can be forged by a Rogue Content Process

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Tom Ritter [:tjr]]

PContent::PContentPermissionRequest accepts a principal from the content process and uses it to request and store permissions. A rogue content process could supply a fraudulent principal and potentially trick the user into granting access for a different domain.  

Alternately, I believe the Content Process could supply a principal the user has granted persistent access to and thus bypass the permission check.

We should validate the principal supplies is valid for the origins the content process is hosting.

Comment 1

[Chris Peterson [:cpeterson]]

This bug is not a Fission MVP blocker.

Comment 14

[Tom Schuster]

I did some investigation into this, and it looks like there is actually a big blocker for doing this work.

The webcompat addon uses the privileged requestStorageAccessForOrigin API to actually do third-party permission request to unblock broken pages. We can't tell whether that request is actually coming from the web compat code or a malicious content process.

The relevant test failures are in toolkit/components/antitracking/test/browser/browser_storageAccessPrivilegeAPI.js.

I am unassigning myself for now to focus on something else, I had hoped this would be a simple change.

Comment 19

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

FWIW I'm doing some relevant work in bug 2050884