1720926 - (CVE-2021-43545) Location API rate limit code does not cover location.reload

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Paul Zühlcke [:pbz]]

Calls to location.reload() are not rate limited and thus can be used to DoS the parent process.
While testing on Ubuntu this also caused Firefox to exhaust my RAM and caused the desktop environment to get slower, freeze and finally crash.

while(true) location.reload();

Marking this a sec-bug for now, because Bug 1314912 was.

Comment 1

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Hey, Paul, will you be able to help add rate limits for this API?

Comment 2

[Paul Zühlcke [:pbz]]

Attachment: Bug 1720926 - Rate limit calls to location.reload. r=smaug!

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Landed: https://hg.mozilla.org/integration/autoland/rev/21276955f659026ff55e579d9ca37a284552e7b3

Backed out for causing hybrid (= non-unified) bustages on nsIPrincipal.
https://hg.mozilla.org/integration/autoland/rev/ee8efced380b871deac4fba285955953a4a89ef5

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&resultStatus=usercancel%2Ctestfailed%2Cbusted%2Cexception%2Cretry&revision=21276955f659026ff55e579d9ca37a284552e7b3
Failure log: https://treeherder.mozilla.org/logviewer?job_id=355149278&repo=autoland

[task 2021-10-18T12:48:01.196Z] 12:48:01     INFO -  In file included from /builds/worker/workspace/obj-build/dist/include/nsIScriptSecurityManager.h:14:
[task 2021-10-18T12:48:01.196Z] 12:48:01     INFO -  /builds/worker/workspace/obj-build/dist/include/nsIPrincipal.h(338,20): error: inline function 'nsIPrincipal::IsSystemPrincipal' is not defined [-Werror,-Wundefined-inline]
[task 2021-10-18T12:48:01.196Z] 12:48:01     INFO -         inline bool IsSystemPrincipal() const;
[task 2021-10-18T12:48:01.196Z] 12:48:01     INFO -                     ^
[task 2021-10-18T12:48:01.196Z] 12:48:01     INFO -  /builds/worker/checkouts/gecko/dom/base/nsHistory.cpp(167,45): note: used here
[task 2021-10-18T12:48:01.196Z] 12:48:01     INFO -    CallerType callerType = aSubjectPrincipal.IsSystemPrincipal()
[task 2021-10-18T12:48:01.196Z] 12:48:01     INFO -                                              ^

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Rate limit calls to location.reload. r=smaug
https://hg.mozilla.org/integration/autoland/rev/4fdbdd93041201a41afc9590f4232267d9ecac7e
https://hg.mozilla.org/mozilla-central/rev/4fdbdd930412

Comment 5

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR91 approval when you get a chance.

Comment 6

[Paul Zühlcke [:pbz]]

Comment on attachment 9246207 [details]
Bug 1720926 - Rate limit calls to location.reload. r=smaug!

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration:
• User impact if declined: Sites can make repeated calls to location.reload() slowing down or freezing the browser, potentially causing OS stability issues. due to memory exhaustion. These DoS attacks are often used to trick users into calling scam hotlines.
• Fix Landed on Version: 95
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Small code change with automated test coverage which had bake time in Nightly and Beta. The underlying rate limiting mechanism has been deployed in Firefox for a long time and is well understood.
• String or UUID changes made by this patch:

Comment 7

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9246207 [details]
Bug 1720926 - Rate limit calls to location.reload. r=smaug!

Approved for 91.4esr.

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/ffde89696567

Comment 9

[Frederik Braun [:freddy]]

Attachment: advisory.txt