1586926 - Add caller access checks for cross-process Location-based navigation

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect, P2)

Description

[Kris Maglione [:kmag]]

We attempt to enforce the same (approximate) access checks to Location-based navigation that we use for loads that use named targeting (e.g., via window.open), so that a frame that can't be navigated via, e.g., window.open, also can't be navigated via, e.g., window.parent[1].location = url. For the in-process case, this is handled by a somewhat hidden call to CheckLoadingPermissions() in nsDocShell::InternalLoad, where the former checks whether the principal of whatever JS context happens to be on the stack subsumes the principal of the target DocShell or any of its ancestors, and blocks the load if it doesn't.

Since there is no JS context on the stack when we call into the DocShell loading code in the cross-process case, the check is simply ignored.

So we need to instead do the check in BrowsingContext::LoadURI, where we already have an explicit accessor, and can simply use the standard access checks that we use elsewhere.

Comment 1

[Kris Maglione [:kmag]]

Attachment: Bug 1586926 - Add necessary caller access checks for cross-process Location navigations. r=nika

We attempt to enforce the same (approximate) access checks to Location-based
navigation that we use for loads that use named targeting (e.g., via
window.open), so that a frame that can't be navigated via, e.g., window.open,
also can't be navigated via, e.g., window.parent[1].location = url. For the
in-process case, this is handled by a somewhat hidden call to
CheckLoadingPermissions() in nsDocShell::InternalLoad, where the former checks
whether the principal of whatever JS context happens to be on the stack
subsumes the principal of the target DocShell or any of its ancestors, and
blocks the load if it doesn't.

Since there is no JS context on the stack when we call into the DocShell
loading code in the cross-process case, the check is simply ignored.

So we need to instead do the check in BrowsingContext::LoadURI, where we
already have an explicit accessor, and can simply use the standard access
checks that we use elsewhere.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/a3d7e24bd090
Add necessary caller access checks for cross-process Location navigations. r=nika

Comment 3

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/mozilla-central/rev/a3d7e24bd090