1917903 - Add an allowlist for WebChannel channel IDs

Status: NEW

(Toolkit :: General, enhancement)

Description

[Andrew McCreight [:mccr8]]

WebChannels grant powerful capabilities to specific webpages. I've been looking them over recently, and one big problem I've had is that any random chrome JS code can create one, like this chunk of code in BrowserGlue, so it is not easy to tell how many of these are floating around out there in the Firefox code base.

The best approach I've been able to come to find them is a pair of SearchFox searches. This first one seems to find the non-test uses ("account_updates", "remote-troubleshooting" and "profiler.firefox.com") and the second one seems to turn up test uses, but hey maybe there are some more out there?

For the same reason it is also very difficult to find the history of when these were added or removed. For bug 1275612, I was trying to figure out when two URLs on a WebChannel allow list were actually used and I was not able to. The check was added in Firefox 50 in bug 1238128 in 2016, so surely they must have existed then, but on SearchFox we only have ESR45 and ESR60 I couldn't find any evidence of them, so maybe they were removed at some point between ESR50 and ESR60. Or maybe I did a bad job looking for them.

Anyways, I think a possible solution to this problem is to have an explicit allow list of channel IDs in the WebChannel constructor. Anything not on the list would be rejected. It would be nice to also explicitly restrict the sites we're giving permission to, but a lot of these are based on prefs which would make it messy. Firefox Accounts has some non trivial logic to decide what the site is. I think a list of channel IDs is enough to get any audit started and should be doable without pulling in much logic from another part of the codebase.

Two minor wrinkles are

• The channel ID for Firefox accounts is defined as WEBCHANNEL_ID in FxAccountsCommon.sys.mjs, so we probably want to grab it from there instead of hard coding it. I think that's a very minor entanglement, so hopefully that will be okay with FxAccounts people.
• There are a lot of weird channels created for tests, as seen above. It looks like maybe no more than two are active at any given time. We could either have a list of specific test web channel ids, like maybe "test-webchannel1" and "test-webchannel2", or allow any channel ID that starts with the string "test". I think the name is not that important so something simpler like the first option might be better. Ideally we'd also only allow test channels in automation but that does risk breaking Firefox outside of testing in a way that automation doesn't catch. But maybe we'd prefer that to allowing some weird test WebChannel to work.

My patch in bug 1917892 simplifies browser_remoteTroubleshoot.js in a way that might make this easier.