1860033 - Clear on shutdown does not clear cookies set for IPv6 hosts

Status: RESOLVED FIXED

(Toolkit :: Data Sanitization, defect, P2)

Description

[Paul Zühlcke [:pbz]]

Cookies added for IPv6 hosts don't get cleared on shutdown even if sanitize on shutdown is enabled.

I suspect the issue is that nsIPrincipal serializes IPv6 hosts differently than the cookie service. For a given URI, e.g. https://[2606:4700:4700::1111]/ the cookie service will store the host as [2606:4700:4700::1111] whereas nsIPrincipal#host returns 2606:4700:4700::1111. This mismatch leads to cookies from IPv6 principals not being cleared here. We pass in a host without brackets where the cookie service expects /keys by hosts with brackets.

Here is the stack trace for a sanitize-on-shutdown call clearing cookies:

deleteByHost (resource://gre/modules/ClearDataService.sys.mjs#125)
deleteByHost (resource://gre/modules/ClearDataService.sys.mjs#124)
deleteByPrincipal (resource://gre/modules/ClearDataService.sys.mjs#137)
deleteDataFromPrincipal (resource://gre/modules/ClearDataService.sys.mjs#1734)
promises (resource://gre/modules/ClearDataService.sys.mjs#1835)
promises (resource://gre/modules/ClearDataService.sys.mjs#1834)
_deleteInternal (resource://gre/modules/ClearDataService.sys.mjs#1832)
deleteDataFromPrincipal (resource://gre/modules/ClearDataService.sys.mjs#1733)
sanitizeSessionPrincipal (resource:///modules/Sanitizer.sys.mjs#1043)
sanitizeSessionPrincipal (resource:///modules/Sanitizer.sys.mjs#1041)
maybeSanitizeSessionPrincipals (resource:///modules/Sanitizer.sys.mjs#959)
maybeSanitizeSessionPrincipals (resource:///modules/Sanitizer.sys.mjs#950)
clear (resource:///modules/Sanitizer.sys.mjs#389)
sanitizeInternal (resource:///modules/Sanitizer.sys.mjs#785)
sanitize (resource:///modules/Sanitizer.sys.mjs#286)
sanitizeOnShutdown (resource:///modules/Sanitizer.sys.mjs#857)
runSanitizeOnShutdown (resource:///modules/Sanitizer.sys.mjs#359)

Comment 1

[Paul Zühlcke [:pbz]]

I've verified that this is the root cause by running the following calls in the browser console:

// Initially, there is an IPV6 cookie
Services.cookies.cookies
Array [ XPCWrappedNative_NoHelper ]

Services.cookies.cookies.map(c => c.rawHost)
Array [ "[2606:4700:4700::1111]" ]

// Calling remove with a host without brackets
Services.cookies.removeCookiesFromExactHost(
        "2606:4700:4700::1111",
        JSON.stringify({})
      );
undefined
// The cookie is still there
Services.cookies.cookies.map(c => c.rawHost)
Array [ "[2606:4700:4700::1111]" ]

// Calling remove with a host with brackets
Services.cookies.removeCookiesFromExactHost(
        "[2606:4700:4700::1111]",
        JSON.stringify({})
      );
undefined
// The cookie has been removed.
Services.cookies.cookies.map(c => c.rawHost)
Array []

Comment 2

[Paul Zühlcke [:pbz]]

IPV6 cookies don't seem that common so I'm setting this to an S3.

Comment 3

[Leander Schwarz]

Attachment: Bug 1860033 - removeCookiesFromExactHost by serialized baseDomain for IPv6 cookies. r?pbz

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/0027da61966d
removeCookiesFromExactHost by serialized baseDomain for IPv6 cookies. r=pbz,cookie-reviewers,valentin

Comment 5

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/0027da61966d