602198 - Reduce privilege of the Web Console Network Inspector

Status: RESOLVED FIXED

(DevTools :: General, defect)

Description

[Kevin Dangoor]

Comments from dveditz during the security review of the Web Console:

Inspect Network Request panel

    we do seem to encode/escape data
    use <browser type="content> to reduce privilege
        except chrome:// is still privileged
        switch to a resource: template maybe?
        or maybe a special about: page (unprivileged, of course)
        create from scratch into a data: or about:blank document? 
    disable javascript and plugins on the docshell


Additional input from gavin:
we should use an iframe as we do with the inspector
http://mxr.mozilla.org/mozilla-central/source/browser/base/content/inspector.js?force=1#467

Comment 1

[Rob Campbell [:rc] (:robcee)]

that should be fairly easy to implement.

Comment 2

[Rob Campbell [:rc] (:robcee)]

Attachment: Net Panel iframe

converted <browser> to <iframe>, type: "content".

Tests passed with no changes.

Comment 3

[Rob Campbell [:rc] (:robcee)]

Attachment: Net Panel iframe (really)

The Real Net Panel iframe Patch

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Comment on attachment 483500 [details] [diff] [review]
Net Panel iframe (really)

r=me, but might want to rename the property to "iframe" just for clarity, and change the two "browser" references in the comments for update().

Comment 5

[Rob Campbell [:rc] (:robcee)]

Sounds good. Thanks!

Comment 6

[Rob Campbell [:rc] (:robcee)]

Attachment: Net Panel iframe (post-review)

carrying review forward. Ready to checkin.

Comment 7

[Rob Campbell [:rc] (:robcee)]

missed a variable rename. Updated patch forthcoming.

Comment 8

[Rob Campbell [:rc] (:robcee)]

Attachment: [checked-in] Net Panel iframe (post-review, really)

Passed unittests

Comment 9

[Rob Campbell [:rc] (:robcee)]

Comment on attachment 483570 [details] [diff] [review]
[checked-in] Net Panel iframe (post-review, really)

http://hg.mozilla.org/mozilla-central/rev/0a8ccb9ecdce

Comment 10

[Rob Campbell [:rc] (:robcee)]

reopening. I checked in the original, unupdated version of this patch.

Will reland with correct bits tomorrow.

Comment 11

[Rob Campbell [:rc] (:robcee)]

Comment on attachment 483570 [details] [diff] [review]
[checked-in] Net Panel iframe (post-review, really)

http://hg.mozilla.org/mozilla-central/rev/dfcca662079e