2072993 - Content classifier blocks first-party requests made from extension content scripts

Status: RESOLVED FIXED

(Core :: Privacy: Anti-Tracking, defect, P2)

Description

[Tim Huang[:timhuang]]

ContentClassifierRequest(nsIChannel*) marks the request valid before it derives the request host, the site and the third-party flag. Every failure after that point returns early and leaves the constructor defaults in place.

The problematic case is a loading principal without a base domain. A fetch from an extension content script carries an expanded principal, whose GetBaseDomain returns NS_ERROR_NOT_AVAILABLE, so the request is classified as third-party regardless of context. On a site that is on a tracker list, a content script's fetch to the page's own origin is blocked. This is undesirable.

Comment 1

[Tim Huang[:timhuang]]

Attachment: Bug 2072993 - Only mark a ContentClassifierRequest valid once its site and third-party flag are derived. r?emz!

The channel constructor set mValid before deriving the host, site and
third-party flag, so any later early return handed the engine a request
built from the constructor defaults, where mThirdParty is true. A loading
principal without a base domain, such as the expanded principal of a
content-script fetch, took that path and got first-party requests to a
listed site blocked. Keep classifying those requests with an empty source
site, and set mValid last.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b5925e603d3a
https://hg.mozilla.org/integration/autoland/rev/8f831d9f95de
Only mark a ContentClassifierRequest valid once its site and third-party flag are derived. r=emz

Comment 3

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/8f831d9f95de