1660115 - UrlClassifierExceptionListService instantiates RemoteSettingsClient in the content process

Status: ASSIGNED

(Core :: Privacy: Anti-Tracking, defect, P2)

Description

[Rob Wu [:robwu]]

STR:

1. Start Firefox, disable third party cookies.
2. Open the global JS console and enable "Show Content Messages" (via the gears icon).
3. Visit a PDF file, e.g. https://hg.mozilla.org/mozilla-central/raw-file/tip/dom/security/test/csp/dummy.pdf
4. Look at the global JS console.

Expected:

• No errors (at least not the one below, filter by "hut" to filter uninteresting log messages)

Actual:

can't access property "addBlocker", AsyncShutdown.profileBeforeChange is undefined Database.jsm:462
    ensureShutdownBlocker resource://services-settings/Database.jsm:462
    Database resource://services-settings/Database.jsm:28
    RemoteSettingsClient resource://services-settings/RemoteSettingsClient.jsm:282
    get resource://gre/modules/XPCOMUtils.jsm:58
    hasLocalData resource://services-settings/Utils.jsm:102
    get resource://services-settings/RemoteSettingsClient.jsm:353
    lazyInit resource://gre/modules/UrlClassifierExceptionListService.jsm:116
    registerAndRunExceptionListObserver resource://gre/modules/UrlClassifierExceptionListService.jsm:144
    onStartRequest resource://pdf.js/PdfStreamConverter.jsm:1182

I used mozregression (mozregression -g 79 --pref network.cookie.cookieBehavior:1 devtools.browserconsole.contentMessages:true -a https://hg.mozilla.org/mozilla-central/raw-file/tip/dom/security/test/csp/dummy.pdf) and the regression range points to bug 1649700. I'm however not marking it as a regression of that bug, because it seems that there is actually an issue in the implementation of the URL classifier.

RemoteSettings is supposed to run in the main process only, but somehow the logic is triggered from the content process.

Comment 1

[Mathieu Leplatre [:leplatrem]]

Thanks Rob for reporting this!

I'm happy to help, but I'm not sure if I'm the best to put in the loop here :(

We've had conversations in the past about instantiation of RemoteSettings clients for the URL classifier. I believe Dimi and Gijs will have more insights to share.