2054896 - Remove the "--remote-allow-system-access" command line argument for Firefox

Status: RESOLVED FIXED

(Remote Protocol :: Agent, task, P2)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Once bug 2054887 and bug 2037819 are fixed, we should consider removing the -remote-allow-system-access command-line argument from Firefox, as it will no longer be necessary.

Removing it would also prevent WebDriver clients from specifying the argument through moz:firefoxOptions in New Session capabilities, where it currently provides an easy way to enable system access when creating a WebDriver session.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

We cannot do that before geckodriver 0.37.1 was released. So lets block on bug 2051391.

Comment 2

[Henrik Skupin [:whimboo][⌚️UTC+1]]

There is no active security issue associated with this change. The work here is intended to further harden WebDriver by making access to privileged browser contexts more explicit. In particular, it prevents users from inadvertently enabling privileged access (such as evaluating scripts in Gecko chrome contexts) via command-line arguments, and instead requires the MOZ_REMOTE_ALLOW_SYSTEM_ACCESS environment variable to be set explicitly.

Given that this is a defense-in-depth improvement rather than a fix for a known exploitable vulnerability, I think we could consider making this bug public?

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Attachment: (secure)

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Attachment: (secure)

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I can only land the first patch this week which requires an upstream sync to the wpt repository. Once that's done we can also land the removal of the Firefox argument. But for that we should wait until the next merge on Monday to not cause any issues that late in the 158 nightly (and soon beta) cycle.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/23b35fd480f4
https://hg.mozilla.org/integration/autoland/rev/1c7fb73211a3
[wpt] Use the MOZ_REMOTE_ALLOW_SYSTEM_ACCESS environment variable to enable system access. r=webdriver-reviewers,jgraham,jdescottes

Comment 7

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1c7fb73211a3

Comment 8

[Henrik Skupin [:whimboo][⌚️UTC+1]]

The upstream PR for the landed wptrunner changes is https://github.com/web-platform-tests/wpt/pull/62927.

Comment 9

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to Henrik Skupin [:whimboo][⌚️UTC+2] from comment #8)

The upstream PR for the landed wptrunner changes is https://github.com/web-platform-tests/wpt/pull/62927.

And it got admin merged. That means we are good to go for the removal of the argument in Firefox once the next merge to beta happened.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/e567adf15bcb
https://hg.mozilla.org/integration/autoland/rev/acc3c4f6421c
[remote] Remove the "--remote-allow-system-access" command line argument. r=webdriver-reviewers,jdescottes,gerard-majax,geckodriver-reviewers

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/acc3c4f6421c

Comment 12

[Ryan VanderMeulen [:RyanVM]]

Should this be closed now?

Comment 13

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Yes, this is now done.

Comment 14

[Julian Descottes [:jdescottes]]

This is an API change, should we disclose this bug so it can be mentioned in release notes clearly?

Comment 15

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Yes, we just opened it up.