1554277 - Check process source for messages in GeckoView

Status: NEW

(GeckoView :: Extensions, task, P3)

Description

[[ex-Mozilla] Agi Sferro | :agi]

I'm filing this because I don't want to forget about it. This might turn into a meta bug.

Right now GeckoView's java layer seems to accept messages from all processes indiscriminately.

E.g. there doesn't seem to be a way for GeckoView to enforce that GeckoView:MediaPermission comes from the main process and not from a compromised content process.

This is even more important with multiple content processes and fission, as we should enforce that we receive messages only from GeckoSession instances that are running on a given content process.

In Gecko this is done by checking the messageManager instance, see here https://searchfox.org/mozilla-central/rev/4606c7974a68cab416c038acaedcae49eed93822/toolkit/components/extensions/ExtensionParent.jsm#370

Comment 1

[Chris Peterson [:cpeterson]]

P3 because we only have one content process today, though it sounds like this is still an issue now when processing messages sent from the main process to itself?

E.g. there doesn't seem to be a way for GeckoView to enforce that GeckoView:MediaPermission comes from the main process and not from a compromised content process.

Comment 2

[[ex-Mozilla] Agi Sferro | :agi]

Mass moving bugs to the Extension component.

Comment 3

[Chris Peterson [:cpeterson]]

Tasks should have severity N/A.