1543502 - Make sure addons/serviceworkers can't intercept TRR requests

Status: RESOLVED INVALID

(Core :: Networking: DNS, defect, P2)

Description

[Valentin Gosu [:valentin] (he/him)]

Currently webextensions can use the webRequest API to intercept HTTP/S requests. Service workers can also intercept requests. If they are able to do this for the TRR connection they could see and modify all DNS requests for any domains.

We need to make sure that we don't call CallOnModifyRequestObservers() and similar methods for the TRR service channel.

Comment 1

[Honza Bambas (:mayhemer)]

Relates to sec-proxy, but probably doesn't necessarily blocks it.

Comment 2

[Dragana Damjanovic [:dragana]]

(In reply to Honza Bambas (:mayhemer) from comment #1)

Relates to sec-proxy, but probably doesn't necessarily blocks it.

This not a secure proxy bug. In mean time I found out that webExtensions cannot access trr connection anyway because they use systemprincipal. Therefore this is not a bug. For service workers I am not 100% sure but I expect that is fine as well. (The secure proxy webExtension can access trr connections but that is fine too)

Comment 3

[Nhi Nguyen (:nhi)]

Remove blockage on secure proxy based on comment #2.

Comment 4

[Valentin Gosu [:valentin] (he/him)]

Based on comment 2 it seems that we are OK with this?