1628783 - Make FPI affect keying of docgroup

Status: NEW

(Core :: DOM: Security, defect, P5)

Description

[Anne (:annevk)]

I think currently docgroup is keyed on eTLD+1. This should really be scheme + eTLD+1 (i.e., https://html.spec.whatwg.org/#site).

If websites opt-in, we are planning on changing the keying from site to origin. See bug 1601594. (I suspect it would be best for any fix here to build on that, but ultimately defer to Tom Tung on that.)

I also believe that currently, FPI does not affect docgroup keying. Since the goal of FPI is that when A embeds B1 and B1 popups B2, B1 and B2 are as isolated from each other as A and B1 are (assuming that the Bs are same-site and A is cross-site from the Bs), B1 and B2 ought to be in different docgroups (i.e., agents).

The observable effect of this would be that B1 and B2 can have shared memory (that uses docgroup as a key), despite FPI trying to forbid that in spirit.

(This takes us further from suggestions in bug 1321158, but I think that ought to be INVALID/WONTFIX.)

Comment 1

[Tom Ritter [:tjr]]

(In reply to Anne (:annevk) from comment #0)

The observable effect of this would be that B1 and B2 can have shared memory (that uses docgroup as a key), despite FPI trying to forbid that in spirit.

To be explicit and make sure I understand - this observable effect is what is presently happening; and fixing this by involving FPI in the docgroup keying would ensure they cannot have shared memory. Right?

Comment 2

[Anne (:annevk)]

I strongly suspect so, but haven't written a test. There would be other ways to mitigate that, FWIW, so I'd rather focus on the more theoretical rationale that this is something keyed by origin/site and FPI ought to impact such state.

Comment 3

[Firefox Bug Husbandry Bot]

Because this bug's Severity has not been changed from the default since it was filed, and it's Priority is P3 (Backlog,) indicating it has been triaged, the bug's Severity is being updated to S3 (normal.)

Comment 4

[Anne (:annevk)]

This does not block dFPI since popups have a special status there and their problems are tracked by bug 1556816 and bug 1657250 already. This would still make sense for a strict version of FPI.