1651665 - chrome_settings_overrides permits insecure search providers

Status: RESOLVED FIXED

(WebExtensions :: General, defect, P1)

Description

[Rob Wu [:robwu]]

In https://hg.mozilla.org/mozilla-central/rev/48dbf3178e91 , the regexp for search_url, suggest_url and search_form was changed to permit localhost, 127.0.0.1 and [::1].

Unfortunately, these regexes did not append a port/host name delimiter after these hosts, so it is possible to bypass the regexp by specifying values like http://localhost.example.com/.

This should be fixed and uplifted to 79.

Comment 1

[Rob Wu [:robwu]]

Attachment: Bug 1651665 - Remove http:-URL validation bypasses from chrome_settings_overrides.search_provider

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b7834f7c0f08
Remove http:-URL validation bypasses from chrome_settings_overrides.search_provider r=mixedpuppy

Comment 3

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/b7834f7c0f08

Comment 4

[Rob Wu [:robwu]]

Comment on attachment 9162656 [details]
Bug 1651665 - Remove http:-URL validation bypasses from chrome_settings_overrides.search_provider

Beta/Release Uplift Approval Request

• User impact if declined: Extensions can register search providers with insecure URLs.
  Recent regression in 79.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The fix consist of making a regexp more strict than what landed in 79 (but still more lax than what already exists in 78 to support bug 1612013). Its functionality is fully covered by unit tests.
• String changes made/needed:

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9162656 [details]
Bug 1651665 - Remove http:-URL validation bypasses from chrome_settings_overrides.search_provider

Approved for 79.0b8.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/e6d101dbff5b