1783489 - Implement CSP 'webrtc' directive

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Seirdy]

CSP3 now has a "webrtc" directive. It accepts the values 'allow' and `'block'. This is particularly useful since WebRTC doesn't go through Fetch.

The "webrtc" directive was added in April.

Specification: https://w3c.github.io/webappsec-csp/#directive-webrtc

Comment 1

[ianopolous]

We need this in Peergos to enable us to run untrusted web apps over private data, without the possibility of the app stealing the data.

We describe the use case more and link related browser issues here:
https://github.com/Peergos/Peergos/issues/1044

Comment 2

[Tom Schuster (MoCo)]

See also github issue The editor's draft includes several features that no one has shipped, which doesn't have a clear decision on removing webrtc, but dveditz commented positively.

Even after this is fixed, there would probably still be ways of exfiltrating data. E.g. I am not sure if WebTransport couldn't be used just like WebRTC. (Edit: Seems like WebTransport is covered by connect-src)

Comment 3

[Frederik Braun [:freddy]]

CSP never had the stated goal of preventing exfiltration. In fact, there are known exfiltration mechanisms that CSP will not be able to stop, regardless of the browser. Even Chrome plans to remove navigate-to (or maybe they already unshipped?).

That being said, I think this is a laudable goal and there's value in exploring corner cases & bypasses in order for us to make a better attempt at taking this into consideration for future standard work. But so far, it shouldn't be expected to be reliable.

Aside: I know most requests in web specifications are based on the fetch concept and could likely be prevented with a ServiceWorker but Shift+Reload bypasses it and navigations are never in scope of a ServiceWorker.

Comment 4

[ianopolous]

I think it depends on the threat model assumed. In our design the untrusted web app is served from a service worker on a sandboxed iframe on an isolated subdomain (it is E2E encrypted, so it's decrypted in an outer trusted context and passed to the ServiceWorker to serve). As far as I'm aware the dns-prefetch and webrtc are the only current exfiltration avenues. Our design is explained more here: https://book.peergos.org/features/apps.html

If there are other exfiltration avenues then I am of course very interested.

Another app, Deltachat, has come up with various ways to try and disable webrtc manually: https://delta.chat/en/2023-05-22-webxdc-security