1997282 - Notification icons are loaded and decoded in the parent

Status: RESOLVED FIXED

(Core :: DOM: Notifications, defect, P3)

Description

[Tom Schuster]

The code in https://searchfox.org/firefox-main/source/toolkit/components/alerts/AlertNotification.cpp loads and decodes icons used by the notifications in the parent process. From what I know we also have other platform specific implementations, but they probably have a similar problem.

Like other dependencies of bug 1878251, we should only be decoding untrusted image data inside a sandboxed process.

Comment 1

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

We should also take care of cases where AlertNotification is used directly by parent process 👀

Comment 2

[Tom Schuster]

(In reply to Kagami Rosylight [:saschanaz] (they/them) (inactive until 2025-11-14) from comment #1)

We should also take care of cases where AlertNotification is used directly by parent process 👀

Do you mean cases like this: https://searchfox.org/firefox-main/search?q=symbol:%23showAlertNotification&redirect=false. I really hope that all code creating notifications in the parent process is trusted. (Not talking about the case where we forward a notifcation from the child of course)

Comment 3

[Kagami Rosylight 🏳️‍🌈🏳️‍⚧️ [:saschanaz] (they/them)]

(In reply to Tom Schuster (MoCo) from comment #2)

I really hope that all code creating notifications in the parent process is trusted. (Not talking about the case where we forward a notifcation from the child of course)

Agreed, I meant to say that we shouldn't break such trusted notifications.

Comment 4

[Tom Schuster]

Attachment: (secure)

Comment 5

[Tom Schuster]

Attachment: (secure)

Comment 6

[Tom Schuster]

Attachment: (secure)

Comment 7

[Tom Schuster]

Attachment: (secure)

Comment 8

[Tom Schuster]

Attachment: (secure)

Comment 9

[Tom Schuster]

Attachment: (secure)

Comment 10

[Tom Schuster]

Attachment: (secure)

Comment 11

[Tom Schuster]

Attachment: (secure)

Comment 12

[Tom Schuster]

This is still missing chrome code that uses nsIAlertNotifcation with an imageURL. We will need to update those consumers to also provide the image.

Comment 13

[Tom Schuster]

Attachment: (secure)

Comment 14

[Tom Schuster]

Attachment: (secure)

Comment 15

[Tom Schuster]

Attachment: (secure)

Comment 16

[Tom Schuster]

Attachment: (secure)

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ef0fa7e5fba2
https://hg.mozilla.org/integration/autoland/rev/b7604c9b613e
Add image to nsIAlertNotification. r=saschanaz
https://github.com/mozilla-firefox/firefox/commit/1fb103733686
https://hg.mozilla.org/integration/autoland/rev/d9065a8e5585
Add new nsContentPolicyType TYPE_INTERNAL_IMAGE_NOTIFICATION. r=necko-reviewers,dom-worker-reviewers,jesup,asuth
https://github.com/mozilla-firefox/firefox/commit/bb84b02d5c39
https://hg.mozilla.org/integration/autoland/rev/172317783b62
Continue to allow mixed content icons for the time being. r=freddyb
https://github.com/mozilla-firefox/firefox/commit/0b20ba586014
https://hg.mozilla.org/integration/autoland/rev/c08a88833b8a
Decode Notification icons in the child. r=saschanaz,asuth
https://github.com/mozilla-firefox/firefox/commit/e5277237b616
https://hg.mozilla.org/integration/autoland/rev/5135f57dc9c1
Use Notification image on macOS. r=saschanaz
https://github.com/mozilla-firefox/firefox/commit/ed4ef78804a0
https://hg.mozilla.org/integration/autoland/rev/333f28d069ff
Use Notification image on Linux/Gnome. r=saschanaz
https://github.com/mozilla-firefox/firefox/commit/f9a7b8f32321
https://hg.mozilla.org/integration/autoland/rev/466337a1fef8
Use Notification image on Windows. r=saschanaz,win-reviewers,nrishel
https://github.com/mozilla-firefox/firefox/commit/009b4a3d24a8
https://hg.mozilla.org/integration/autoland/rev/d0d164697388
Remove nsIAlertNotificationImageListener code. r=saschanaz
https://github.com/mozilla-firefox/firefox/commit/4b7bf7eeef48
https://hg.mozilla.org/integration/autoland/rev/77d3ba687856
Add new test for nsIAlertNotification image. r=saschanaz
https://github.com/mozilla-firefox/firefox/commit/975480db2d9a
https://hg.mozilla.org/integration/autoland/rev/d6e29b6d185b
Update WebExtension notification code for images.  r=saschanaz,extension-reviewers,robwu
https://github.com/mozilla-firefox/firefox/commit/d5e707e8001f
https://hg.mozilla.org/integration/autoland/rev/c4c249737687
Use Notification image in XUL alerts. r=saschanaz,extension-reviewers,robwu
https://github.com/mozilla-firefox/firefox/commit/6e57507de7f1
https://hg.mozilla.org/integration/autoland/rev/5ffc4163edce
apply code formatting via Lando

Comment 18

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/mozilla-central/rev/b7604c9b613e
https://hg.mozilla.org/mozilla-central/rev/d9065a8e5585
https://hg.mozilla.org/mozilla-central/rev/172317783b62
https://hg.mozilla.org/mozilla-central/rev/c08a88833b8a
https://hg.mozilla.org/mozilla-central/rev/5135f57dc9c1
https://hg.mozilla.org/mozilla-central/rev/333f28d069ff
https://hg.mozilla.org/mozilla-central/rev/466337a1fef8
https://hg.mozilla.org/mozilla-central/rev/d0d164697388
https://hg.mozilla.org/mozilla-central/rev/77d3ba687856
https://hg.mozilla.org/mozilla-central/rev/d6e29b6d185b
https://hg.mozilla.org/mozilla-central/rev/c4c249737687
https://hg.mozilla.org/mozilla-central/rev/5ffc4163edce