1698817 - [Cisco Webex] Microphone permission is leaked to other sites in the same tab during the grace period

Status: VERIFIED FIXED

(Firefox :: Site Permissions, defect, P2)

Description

[Timea Cernea [:tbabos][inactive]]

Affected Versions:
Nightly 88.0a1 (2021-03-16)

Tested on:
Windows 7/10 and MacOS

Steps to Reproduce:

1. Go to https://meet42.webex.com
2. Sign In (ask me on Slack for credentials if need be)
3. Start a meeting
4. Choose to join from browser
5. Grant access to the mic and webcam
6. Click on start meeting
7. After the meeting is started navigate to any different site (youtube, 9gag, etc) or ones where microphone access is also needed (do this during the grace period)

For example, go to: https://mozilla.github.io/webrtc-landing/gum_test.html

8. Check the permission icon in the address bar and oberve microphone access is granted
9. Click on "Microphone" on the test page

Expected Result:
The microphone permission prompt should not leak into other sites permissions.

Actual Results:
Microphone permission is leaked to other sites in the same tab during the grace period.
Clicking on "Microphone" will also give access to the user's mic without any prompt for the test site.

Regression-Range:
Most likely regression of Bug 1693677. This is not reproducible if I disable the grace period.
We observed this issue only for this site during testing.

Comment 1

[Timea Cernea [:tbabos][inactive]]

Hey Mike, can you look into this when you have time? Thanks!

Comment 2

[Timea Cernea [:tbabos][inactive]]

Attachment: Screenshot of the issue

Comment 3

[Mike Conley (:mconley) (:⚙️)]

Redirecting to jib.

Comment 4

[Mike Conley (:mconley) (:⚙️)]

[Tracking Requested - why for this release]:

Tracking for 88 - we should make sure that we turn the grace period off in 88 if we can't find a technical solution here in time.

Comment 5

[Mike Conley (:mconley) (:⚙️)]

To be clear, tbabos, if you disable the grace period (set privacy.webrtc.deviceGracePeriodTimeoutMs to 0 in about:config), is this still reproducible?

Comment 6

[Timea Cernea [:tbabos][inactive]]

If I disable the grace period this issue is not reproducible anymore. I just redone it again with grace period enabled (50000s) and disabled (0s) and can confirm it is not reproducible with the grace period disabled (0s).

Comment 7

[Paul Zühlcke [:pbz]]

Attachment: Bug 1698817 WIP Ensure that we use the orignal principal from permission grant when setting grace periods.

Comment 8

[Paul Zühlcke [:pbz]]

I can reproduce via https://www.webex.com/test-meeting.html#. Granting permission, joining the meeting all the way and then navigating to another site, for example example.com.

The issue seems to be that we can get the wrong principal, already the principal of the next page, in webrtc:UpdateIndicators
https://searchfox.org/mozilla-central/rev/f07a609a76136ef779c65185165ff5ac513cc172/browser/actors/WebRTCParent.jsm#175
This is the principal we use for setting the grace period permission.
I've uploaded a WIP patch which fixes this by storing the principal on webrtcUI.activePerms on permission grant. We'll still need to investigate what exactly is causing this though, so we can add a test.

Comment 9

[Paul Zühlcke [:pbz]]

Attachment: Bug 1698817 - Store the correct principal when adding streams to webrtcUI. r=jib!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e9920d3ab21d
Store the correct principal when adding streams to webrtcUI. r=jib

Comment 11

[Paul Zühlcke [:pbz]]

After discussion with :nika we ended up with this simpler fix which doesn't require us to refactor webrtcUI.activePerms. The issue was that getting the documentPrincipal via the BrowsingContext doesn't guarantee that we get the right principal. So for the navigation case we sometimes got the principal for the next document.

Comment 12

[Mike Conley (:mconley) (:⚙️)]

chefs kiss, I love simple fixes.

I wonder if / how / where we should document this potential place for a security footgun for principal confusion.

Comment 13

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/e9920d3ab21d

Comment 14

[Timea Cernea [:tbabos][inactive]]

Verified-fixed on latest Firefox Nightly 88.0a1 (2021-03-19) (64-bit) on Windows 7/10, MacOS 10.15 and Ubuntu 20.04. We also smoked tested general grace period functionality and tried out other sites as well but no issues encountered. Thanks for fixing this so fast!