1985987 - Initial RemoteImageProtocolHandler work

Status: RESOLVED FIXED

(Core :: Graphics, task)

Description

[Tom Schuster]

We don't want to decode untrusted images (in particular favicons) in the parent process. Instead we can introduce a new protocol, that will decode an image in a sandboxed process (probably utility process) and returns the encoded bitmap data for a safe static version of that image.

Comment 1

[Tom Schuster]

Attachment: Bug 1985987 - Define the moz-remote-image protocol. r?#necko-reviewers

Comment 2

[Tom Schuster]

Attachment: Bug 1985987 - Parse the moz-remote-image URL. r?emilio

Comment 3

[Tom Schuster]

Attachment: Bug 1985987 - Fetch and decode images in a content process. r?tnikkel!,nika!

Comment 4

[Tom Schuster]

Some things that I still want to improve:

• Introduce a new simple (rawish) image format to re-encode into. (For this first draft I am using PNG) This should make it faster to decode again in the parent and more secure, because PNG and other are still complex formats and we shouldn't trust the data coming from the child.
• Make sure the child sends up image data in the expected format.
• Handle SVG context-fill and CSS color-scheme?
• I probably should introduce a new content process type for this.
• Restrict the content process to a feature set that it could reasonable require. E.g. could we maybe prevent it from video decoding etc?
• Handle a hanging remote process (Maybe automatic?)
• Shutdown the process when idle

Comment 5

[Tom Schuster]

Attachment: Bug 1985987 - Get a process for remote image decoding. r?nika

Comment 6

[Tom Schuster]

I am submitting this for early review to gather some feedback.

Comment 7

[Tom Schuster]

In comment 0 in mentioned using the utility process for decoding images. I didn't manage to get that working. SVGs actually use real documents when decoding, which requires a proper (web) content process to work.

Comment 8

[Tom Schuster]

Attachment: WIP: Bug 1985987 - Add a new imageDecoder remote process type.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/6b617efd7ed2
https://hg.mozilla.org/integration/autoland/rev/e2c8885b527d
Define the moz-remote-image protocol. r=necko-reviewers,valentin
https://github.com/mozilla-firefox/firefox/commit/ad59af6512c1
https://hg.mozilla.org/integration/autoland/rev/97640cf934c0
Parse the moz-remote-image URL. r=emilio
https://github.com/mozilla-firefox/firefox/commit/70238397ad9d
https://hg.mozilla.org/integration/autoland/rev/1375a42a41c0
Get a process for remote image decoding. r=nika
https://github.com/mozilla-firefox/firefox/commit/7b5c8a2baa22
https://hg.mozilla.org/integration/autoland/rev/f53b15142ef3
Fetch and decode images in a content process. r=tnikkel,nika,layout-reviewers

Comment 10

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/e2c8885b527d
https://hg.mozilla.org/mozilla-central/rev/97640cf934c0
https://hg.mozilla.org/mozilla-central/rev/1375a42a41c0
https://hg.mozilla.org/mozilla-central/rev/f53b15142ef3