1591235 - nsContentUtils::ShouldResistFingerprinting(*) methods return false if null is passed as param

Status: RESOLVED FIXED

(Core :: Security, defect, P2)

Description

[Olli Pettay [:smaug][[e-mail]]]

It looks worrisome that one might be able to bypass fingerprinting check if one somehow manages to find a code path which passes null as param.
I would expect return value be ShouldResistFingerprinting();

Comment 1

[Tom Ritter [:tjr]]

I thought for a moment that maybe this was a poorly documented way to say "If we don't have a docshell/document, we're in the system context" but looking at callsites, that seems unlikely... I was less certain about mozilla::dom::Element::SetPointerCapture though.

Still, yes I agree I think they should defer to ShouldResistFingerprinting()

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:wleung, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[hongyu.wang]

Hi, could I work on this bug?

Comment 4

[Tom Ritter [:tjr]]

Sorry, I forgot to set the assignee, I'm currently mentoring someone through this bug.

Comment 5

[Tom Ritter [:tjr]]

Actually, if you would like to do this, it is free and you can work on it, yes.

Comment 6

[hongyu.wang]

I would be happy to work on this bug.

Comment 7

[Jens Hausdorf :jens1o [ni? me]]

Attachment: Bug 1591235 - nsContentUtils::ShouldResistFingerprinting(*) methods should check pref if null is passed as param r=smaug

Comment 8

[Jens Hausdorf :jens1o [ni? me]]

hey :smaug, I wonder whether this is ready for landing?

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

oh, sure. Want me to land this?

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

(it isn't always clear who can land patches.)

Comment 11

[Jens Hausdorf :jens1o [ni? me]]

At least I cannot do it. If you are unable to do it, I would request a checkin-needed note in Phrabicator. Yet if you're able to (and have the time), I'd appreciate it.

Comment 12

[Olli Pettay [:smaug][[e-mail]]]

I can do it :)

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/033702e7e383
nsContentUtils::ShouldResistFingerprinting(*) methods should check pref if null is passed as param r=smaug

Comment 14

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/033702e7e383