1845752 - The System Principal is being used to load search engine images and OpenSearch descriptions

Status: RESOLVED FIXED

(Firefox :: Search, defect, P2)

Description

[Mark Banner (:standard8)]

We have a helper function in SearchUtils that makes a channel using the system principal.

Although the triggeringPrincipal is not specified, it falls back to the loadingPrincipal.

The channel that is created can be used in two places in the code:

1. When installing or updating OpenSearch engines. In the install case (the update case only has the last step):
   • The user has loaded a web page, and we've detected that there is an <link rel="search" type="application/opensearchdescription+xml" in the page with a href for the OpenSearch definition file (an xml).
   • The user then clicks on a button in the search bar or address bar to install the engine.
   • We then go and load the href from the definition and process the file.
2. Loading images (icons) for search engines on installation. These will have been defined in the OpenSearch engine definition, or could also be loaded for Enterprise Policy engines.

Talking with :ckerschb, we should be using a null principal here, as these are cases that could be influenced by the web.

To get this working, we'll also need to correct/change the content type. I think for the first case we'll should use Ci.nsIContentPolicy.TYPE_DOCUMENT and the second case we should use Ci.nsIContentPolicy.TYPE_IMAGE.

In the images code, we can also remove the ftp reference, as Firefox no longer supports loading from ftp.

Comment 1

[Mark Banner (:standard8)]

Attachment: Bug 1845752. r?freddyb!

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/75e8c28bc499
r=ckerschb

Comment 3

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/75e8c28bc499

Comment 4

[Mark Banner (:standard8)]

I chatted with Christoph and Freddy, and we decided that as this is more of a security improvement rather than a vulnerability fix, we wouldn't backport to esr115.

Likewise, I don't think we need to do an uplift to beta in this case. I'm fine either way though if someone thinks we should uplift to beta.

Comment 5

[Brindusa Tot, DTE]

Covered by automated tests. Removing the qe+ flag.

Comment 6

[Daniel Veditz [:dveditz]]

Bulk-unhiding security bugs fixed in Firefox 119-121 (Fall 2023). Use "moo-doctrine-subsidy" to filter