1914068 - Use principal URI for content analysis

Status: VERIFIED FIXED

(Firefox :: Data Loss Prevention, defect)

Description

[David Parks [:handyman]]

Right now we are using the document URI [1][2] but this can give the wrong URI for content like iframes. The list of callers may not be complete.

[1] https://searchfox.org/mozilla-central/source/toolkit/components/contentanalysis/ContentAnalysis.cpp#1737
[2] https://searchfox.org/mozilla-central/source/toolkit/components/contentanalysis/ContentAnalysis.cpp#1963

Comment 1

[Greg Stoll :gstoll]

Does this need to block bug 1882607?

Comment 2

[David Parks [:handyman]]

Whoops. Yeah, I think it should.

Comment 3

[Greg Stoll :gstoll]

Attachment: Bug 1914068 - pass correct URL to Content Analysis for same-origin iframes r=#dlp-reviewers!

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:handyman, could you have a look please?

For more information, please visit BugBot documentation.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/6216b4b406a5
pass correct URL to Content Analysis for same-origin iframes r=dlp-reviewers,win-reviewers,handyman

Comment 6

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/6216b4b406a5

Comment 7

[Greg Stoll :gstoll]

Attachment: Bug 1914068 - pass correct URL to Content Analysis for same-origin iframes

Original Revision: https://phabricator.services.mozilla.com/D220168

Comment 8

[Greg Stoll :gstoll]

esr128 Uplift Approval Request

• User impact if declined: wrong URL may be passed to DLP agent
• Code covered by automated testing: yes
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: n/a
• Risk associated with taking this patch: low
• Explanation of risk level: only affects DLP
• String changes made/needed: no
• Is Android affected?: no

Comment 9

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/f871bb67c6af

Comment 10

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Hello Greg! Is there something we could manually verify here? Thank you in advance!

Comment 11

[Greg Stoll :gstoll]

Hi! I've added automated tests for this, but you can test this manually too.

On this page, any DLP requests should have the URL of the outer page (https://gregstoll.github.io/iframes/prompts_iframe.html) and not the inner page (https://gregstoll.github.io/iframes/prompts.html), since they share the same origin.

On this page, any DLP requests should have the URL of the inner page (https://gregstoll.github.io/iframes/prompts.html) since they do not share the same origin.

Thanks!

Comment 12

[Alexandru Trif, Desktop Test Engineering [:atrif]]

(In reply to Greg Stoll :gstoll from comment #11)

Hi! I've added automated tests for this, but you can test this manually too.

On this page, any DLP requests should have the URL of the outer page (https://gregstoll.github.io/iframes/prompts_iframe.html) and not the inner page (https://gregstoll.github.io/iframes/prompts.html), since they share the same origin.

On this page, any DLP requests should have the URL of the inner page (https://gregstoll.github.io/iframes/prompts.html) since they do not share the same origin.

Thanks!

Thank you! Verified fixed with Firefox 132.0a1 (2024-09-24) and 128.3esr on Windows 11. The correct URL is displayed as stated in comment 11.