1826709 - Prevent /json/* pages from being loaded within an iframe

Status: RESOLVED FIXED

(Remote Protocol :: CDP, defect, P1)

Description

[Henrik Skupin [:whimboo][⌚️UTC+2]]

To prevent leaking connection details for the HTTP endpoints of the CDP implementation to any particular website (see the issue for Chromium) we should stop loading the various /json/* pages within an iframe.

As discussed with Freddy on Slack this is mostly sec-want / sec-low. But I would like to get this fixed to not leak the details, which could be used for potential other security attacks.

Comment 1

[Frederik Braun [:freddy]]

Thinking about this some more, the targetId leaking through e.g., someone screenshotting an evil page (and then putting the json endpoints into an iframe) is probably a leak that we should plug, but definitely not so severe given that we restrict access across origins. Thank you for filing this, Henrik!

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Attachment: Bug 1826709 - [CDP] Prevent "/json/*" pages from being loaded within an iframe.

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

[CDP] Prevent "/json/*" pages from being loaded within an iframe. r=webdriver-reviewers,freddyb,jdescottes
https://hg.mozilla.org/integration/autoland/rev/c741548492665b3b9d65c2eba245be95d2191a86
https://hg.mozilla.org/mozilla-central/rev/c74154849266