1513445 - Disallow http(s) resources to be loaded into system privileged documents

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P2)

Description

[Frederik Braun [:freddy]]

We should not allow top-level documents or subdocuments loaded with the SystemPrincipal to live on the web.

Comment 1

[Frederik Braun [:freddy]]

Green on try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=9556f6d4f279044d31b054390a81c7fbdb94ff17

Comment 2

[Frederik Braun [:freddy]]

Attachment: Bug 1513445 - Disallow web documents loaded with the SystemPrincipal

Bug 1513445 - Disallow web documents loaded with the SystemPrincipal

Comment 3

[Frederik Braun [:freddy]]

New try run. Still green:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=d18b8148c2cd78532bbb5941bb88defee87fe53e

Comment 4

[Frederik Braun [:freddy]]

Pushed to try with the "!xpc::IsInAutomation()" case commented out - otherwise the new codepath is never executed.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=0937c0a71b0fa9c3c8d7a712dda1887c1f4cb74b

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

Assigning to you Freddy since you already are working on a patch...

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Sorry, I meant to assign this one to you Freddy, not to myself (see comment 5 :-) ).

Comment 7

[Frederik Braun [:freddy]]

Attachment: Bug 1513445 - Disallow web documents loaded with the SystemPrincipal

Comment 8

[Frederik Braun [:freddy]]

Attachment: Bug 1513445: add tests

Depends on D19350

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/568de07e5c40
Disallow web documents loaded with the SystemPrincipal r=ckerschb
https://hg.mozilla.org/integration/autoland/rev/499f5b4d205d
add tests r=ckerschb

Comment 10

[Andrei Ciure[:aciure]]

Backed out 2 changesets (bug 1513445) for causing xpc perma fails

push that caused the backout: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&selectedJob=238954089&revision=499f5b4d205d601f41f772e7eff3c52d3927e23e

failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&fromchange=eb58abd1cf11cdc20fa184b65b113df527bf5dba&selectedJob=238957852&searchStr=android%2C4.3%2Capi16%2B%2Cdebug%2Cxpcshell%2Ctests%2Ctest-android-em-4.3-arm7-api-16%2Fdebug-xpcshell-3%2Cx%28x3%29

https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&fromchange=eb58abd1cf11cdc20fa184b65b113df527bf5dba&selectedJob=238961516&searchStr=linux%2Cx64%2Cdebug%2Cxpcshell%2Ctests%2Ctest-linux64%2Fdebug-xpcshell-6%2Cx%28x6%29

backout: https://hg.mozilla.org/integration/autoland/rev/8fcb2ad64899854db6b7a4b27b8c7f518e95e528

Comment 11

[Frederik Braun [:freddy]]

Attachment: Bug 1513445 - Disallow web documents loaded with the SystemPrincipal r=ckerschb

Comment 12

[Frederik Braun [:freddy]]

Attachment: Bug 1513445: add tests r=ckerschb

Depends on D26680

Comment 13

[Frederik Braun [:freddy]]

Ah, thanks for the backout. Turns out, that xpcshell tests do not have a profile necessarily.
New revision should be OK, checks whether non-local connections are disabled.

Comment 14

[Frederik Braun [:freddy]]

Newest revision green on try: https://treeherder.mozilla.org/#/jobs?repo=try&revision=4f40e4945deae99256b74e2ac1f12457a7c9e1d3&selectedJob=239054293

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/18f074af5d93
Disallow web documents loaded with the SystemPrincipal r=ckerschb
https://hg.mozilla.org/integration/autoland/rev/59c870edc677
add tests r=ckerschb

Comment 16

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/18f074af5d93
https://hg.mozilla.org/mozilla-central/rev/59c870edc677