1513003 - PasswordManager:findLogins/:autoCompleteLogins actor topics allow querying for any origin's login

Status: RESOLVED FIXED

(Toolkit :: Password Manager, defect, P2)

Description

The PasswordManager:findLogins request and PasswordManager:loginsFound response allows any origin to query for saved logins for any origin.

We should ensure that the form and action urls that are passed to the parent are valid for the Content Process they originate from.

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

I think this one belongs into IPC rather than dom:sec - pushing it over.

Comment 2

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Assuming the problem is the ominous TODO at [1], `./mach file-info bugzilla-component` says this belongs to Toolkit :: Password Manager.

[1] https://searchfox.org/mozilla-central/rev/adcc169dcf58c2e45ba65c4ed5661d666fc3ac74/toolkit/components/passwordmgr/LoginManagerParent.jsm#74

Comment 3

[Matthew N. [:MattN]]

PasswordManager:autoCompleteLogins is also guilty of this.

Comment 5

[Chris Peterson [:cpeterson]]

This bug is not a Fission MVP blocker.

Comment 6

[:severin Rudie]

Attachment: Bug 1513003 - only allow child process to query logins for the current base domain;r=Mattn

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/319bbb220b30
only allow child process to query logins for the current base domain;r=MattN

Comment 8

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/319bbb220b30