1712580 - Intelligently handle file: origins w.r.t. Spectre

Status: NEW

(Core :: Security, task)

Description

[Tom Ritter [:tjr]]

As described on github and especially in chromium's bugtracker - if an attacker is running a script in a file:// origin, it can use <img> (but not fetch) to get local files in-memory, including things like the cookie jar. Before we disable Spectre mitigations we should ensure we have some mitigations in place for this.

Chrome seems to be headed down a path that does both Site Isolation for file:// origins and some form of CORB for cross-directory requests.

In the shorter term, we could also just not disable Spectre mitigations for file:// origins (and only web origins).

Comment 1

[Nicolas B. Pierron [:nbp]]

How does this relate to JavaScript JITs? Did you meant to set a different component?

Comment 2

[Tom Ritter [:tjr]]

Preset when filing.

Comment 3

[Tom Ritter [:tjr]]

We discussed this and consider it a blocker for disabling Spectre mitigations.

file:// origins are pretty icky for a lot of reasons, so not disabling spectre mitigations feels like a reasonable goal in the short/medium term.