1770848 - ContentPrefService2._observers indexed by a content-controlled value

Status: RESOLVED FIXED

(Toolkit :: Preferences, defect)

Description

[Andrew McCreight [:mccr8]]

ContentPrefsParent::receiveMessage contains the following code, where prefName is msg.data.name, and thus controllable by the content process:

cps2.addObserverForName(prefName, this._observer);

I think that method is defined here. If prefName is "__proto__", then it'll end up with observers being Object.prototype (the proto of _observers), but then it will throw when it tries to call include on it, so nothing bad will happen. There's similar code in removeObserverForName, which will end up throwing in the same way.

In summary, no security issue right now, but maybe _observers could be changed to a Map to make this code a bit more resilient.

Comment 1

[:Gijs (he/him)]

Attachment: Bug 1770848, r?jaws!,mccr8!

Comment 2

[Andrew McCreight [:mccr8]]

It might be nice to backport this to ESR if we can.

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

r=jaws,mccr8
https://hg.mozilla.org/integration/autoland/rev/d715b649f361b580d94fa0eed209e9006cda0219
https://hg.mozilla.org/mozilla-central/rev/d715b649f361

Comment 4

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR91 approval when you get a chance.

Comment 5

[:Gijs (he/him)]

Comment on attachment 9277851 [details]
Bug 1770848, r?jaws!,mccr8!

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: related to a fixed sec-high/crit
• User impact if declined: Potential for more sec bugs
• Fix Landed on Version: 102
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Straightforward same-behaviour refactor of some JS code that has integration level tests and has been on nightly+beta for a little while now.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9277851 [details]
Bug 1770848, r?jaws!,mccr8!

Approved for 91.11esr.

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/91390d8fc142