1847347 - Switch to Secure State Restoration

Status: RESOLVED FIXED

(Core :: Widget: Cocoa, defect, P2)

Description

[Haik Aftandilian [:haik]]

Firefox should implement applicationSupportsSecureRestorableState and switch to application:shouldSaveSecureApplicationState: and application:shouldRestoreSecureApplicationState:.

Security explanation:
https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-macos-security-layers-with-a-single-vulnerability/

Apple docs:
https://developer.apple.com/documentation/appkit/nsapplicationdelegate/3762521-applicationsupportssecurerestora?language=objc
https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1623089-application?language=objc
https://developer.apple.com/documentation/uikit/uiapplicationdelegate/1622987-application?language=objc

Our bug fix that enabled login resume: Bug 639707.

Comment 1

[Kris Wright :KrisWright]

Attachment: Bug 1847347 - Implement applicationSupportsSecureRestorableState.

Along with resume session support we need to support secure state restoration. If I'm reading the AppKit documentation correctly (https://developer.apple.com/documentation/appkit/nsapplicationdelegate/3762521-applicationsupportssecurerestora?language=objc) then we're supposed to implement this ourselves with a true return value.

Depends on D186701

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3b2a73babfd3
Implement applicationSupportsSecureRestorableState. r=mac-reviewers,haik

Comment 5

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/3b2a73babfd3