1959370 - Add an ability to disable and enable security checks per user context for testing

Status: RESOLVED FIXED

(Core :: Security: PSM, task, P2)

Description

[Alexandra Borovova [:Sasha]]

For WebDriver Classic and BiDi we use now SetDisableAllSecurityChecksAndLetAttackersInterceptMyData to disable security checks during the session, if it's requested by a client.
Now we have a new requirement to be able to control this also on user context level: disable these checks for a specific user context.
Our suggestion would be to add an optional userContext argument to SetDisableAllSecurityChecksAndLetAttackersInterceptMyData method to build a list of user contexts and validate against it before checking the global flag mDisableAllSecurityCheck.

Update after the spec has changed:
We also need to be able to enable security checks per user context (even if they are disabled globally). Also we have to be able to reset the state per user context and fallback to the global state. For example, the security checks are disabled globaly and enabled for a certain user context. After session ends, we have to make sure that state for this user context is reset and now they are disabled as it's globally.

Comment 1

[Alexandra Borovova [:Sasha]]

Attachment: Bug 1959370 - Add an ability to disable and enable security checks per user context for testing.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dfe517acdb50
Add an ability to disable and enable security checks per user context for testing. r=keeler

Comment 3

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/dfe517acdb50