1727803 - about:sync extension bypasses security mechanisms in the browser

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Tom Ritter [:tjr]]

While digging into crashes caused by unexpected Javascript being executed in the parent process (Bug 1727500) I happened to notice that the first several crashes I saw had the about:sync extension installed.

After I installed it in a debug build I immediately got a few violations that included:

Lack of a secure Content Security Policy - nsContentSecurityUtils::AssertAboutPageHasCSP: foundDefaultSrc (about: page must contain a CSP including default-src)

data: uris being loaded by the parent - data:,new function() {\n Components.utils.import(\"chrome://aboutsync/content/AboutSyncRedirector.js\");\n AboutSyncRedirector.register();\n}

It seems like this extension has a relatively small user-base (~1100 users per AMO) and is relatively stable (no new commits in 2 years.) (Unrelated, it's also pretty awesome; I had no idea it existed.)

Comment 1

[Tom Ritter [:tjr]]

Attachment: Bug 1727803: Create security exemptions for about:sync and about:downloads r?freddyb

This will also fix Bug 1727770

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2664ad84ad11
Create security exemptions for about:sync and about:downloads r=freddyb

Comment 3

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/2664ad84ad11