1652707 - nsContentSecurityUtils::IsEvalAllowed should use filename comparison instead of StringBeginsWith

Status: RESOLVED WONTFIX

(Core :: DOM: Security, enhancement, P3)

Description

[Frederik Braun [:freddy] (OOO until August 18th)]

When going through the loop of allowlist entries, we use a StringBeginsWith check to ensure we do not sumble over script locations like resource://gre/modules/workers/require.js line 138 > Function.

Instead, we might be able to use

nsCOMPtr<nsIStackFrame> location = GetCurrentJSStack(1)
JSContext* cx = nsContentUtils::GetCurrentJSContext();
location->GetFilename(cx, caller);

and compare those instead

Comment 1

[ola-oluwa]

Hi please i would like to work on this

Comment 2

[ola-oluwa]

Attachment: Bug 1652707- nsContentSecurityUtils::IsEvalAllowed should use filename comparison instead of StringBeginsWith. r?tjr

Comment 3

[Tom Ritter [:tjr] (OOTO until 9/2)]

It turns out we can't fix this. The prefix-based comparison is needed because an exact match will need to include the line number of the offending call; and hardcoding that is too brittle. Performing a regex match (on the hot path) would be prohibitively expensive and wouldn't work off-main-thread. Emulating a regex match would be possible, but complicated and doesn't seem worth it for the versatility we have here.