1647128 - Fetch Metadata Headers contain invalid value for Sec-Fetch-Site for meta redirects

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[terjanq]

Hello Team,

I discovered an issue with the current implementation of Fetch Metadata. When a page is redirected to another domain through meta redirect <meta http-equiv=refresh content="0;url=https://google.com"> then Sec-Fetch-Site will be set to 'none'.

Furthermore, as a result, if the navigation occurs inside an iframe, e.g.

<iframe srcdoc='<meta http-equiv=refresh content="0;url=https://www.google.com">'>

the following headers will be sent to a web server:

Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none

Because 'none', according to the current specification, should indicate a browser indicated request, it can result in the bypass of Fetch Metadata policy by using iframes. (https://www.w3.org/TR/fetch-metadata/#sec-fetch-site-header)

This, for example, could introduce XS-Leaks that the policy is supposed to protect against.

In case of an awarded bounty for this report, please donate the reward to a charity of your choice.

Comment 1

[:Gijs (out until Jan 5th; he/him)]

Christoph, is this your ballpark?

Comment 2

[Christoph Kerschbaumer [:ckerschb}]

Thanks for reporting - we should fix that. Please note that Sec-Fetch Headers are bound to Nightly at the moment, so I guess this bug does not need to be hidden.

Anyway, Anne, I guess simply relying on the referrer here is insufficient. I guess we could additionally check the loadinfo if the channel has been redirected (I assume that meta redirects end up in the loadinfo redirect history).

Or is there anything else I am missing?

Comment 3

[terjanq]

Please note that Sec-Fetch Headers are bound to Nightly at the moment, so I guess this bug does not need to be hidden.

I don't mind the report being public.

Comment 4

[Anne (:annevk)]

Yeah, I thought we discussed the need for an actual user-initiated signal. I don't think we can approximate it.

Comment 5

[Sebastian Streich [:sstreich]]

Attachment: Bug 1647128 - Assert !DocumentLoaded in IsUserTriggeredForSecFetchSite check r=ckerschb

Use hasUsergesture in SecFetch

Comment 6

[Niklas]

Attachment: Bug 1647128 - Detect webby navs caused by meta refreshes in IsUserTriggeredForSecFetchSite check r=ckerschb

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/967958bda4f9
Detect webby navs caused by meta refreshes in IsUserTriggeredForSecFetchSite check  r=necko-reviewers,ckerschb,valentin

Comment 8

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/967958bda4f9

Comment 9

[Tom Ritter [:tjr] (OOTO until April)]

Nightly only doesn't get advisories.