744466 - Isolate DOM Storage to first party domain (Tor 6564)

Status: RESOLVED DUPLICATE of bug 1260931

(Core :: DOM: Security, defect, P2)

Description

[Honza Bambas (:mayhemer)]

+++ This bug was initially created as a clone of Bug #536509 +++

http://scarybeastsecurity.blogspot.com/2009/12/bypassing-intent-of-blocking-third.html claims localStorage does not obey the third-party cookies pref.

After bug 536509 gets fixed, we need to update DOMStorageImpl::CacheStoragePermissions to work with the third-party flag as well.  (Currently we pass false so despite the 3th-party-session-only pref we still persist in multi-process).

My first idea:
- move the mThirdParty flag to DOMStorageBase (a base class for DOMStorageChild and DOMStorageImpl)
- carry it from DOMStorageChild to DOMStorageParent (PStorage at PStorage.ipdl, Init() event, SendInit and RecvInit methods in C++)
- DOMStorageParent sets the flag on its DOMStorageImpl and we are done

Comment 1

[Mike Perry]

We have a patch that is not tied to any pref to isolate DOM storage to the first party URL bar domain (ie "double-key) it. This might be more complex than what you're talking about, but we went with this option to still enable third party DOM storage functionality without the associated cross-site tracking. We prefer this approach for all types of third party identifiers (cache, cookies, DOM storage, etc).

You can have a look at the patch at:
https://gitweb.torproject.org/tor-browser.git/commitdiff/fc3f828978e8ec2347055e276bd6281de72629a8

Let me know if that sounds like something that is worth pursuing instead of simply disabling DOM storage for third parties, or if this approach should have a separate bug and pref.

Comment 2

[Mike Perry]

(In reply to Mike Perry from comment #1)
> You can have a look at the patch at:
> https://gitweb.torproject.org/tor-browser.git/commitdiff/
> fc3f828978e8ec2347055e276bd6281de72629a8

This link was invalidated due to the hash chain invalidation from the Mozilla git mirror switchover. Here's a working link:

https://gitweb.torproject.org/tor-browser.git/commitdiff/1b3c110a29ae11b50ce2bf56d5954773262e67c0

Comment 4

[Arthur Edelstein [:arthur]]

Here's a link that tracks the latest version of the Tor Browser patch:
https://torpat.ch/6564
and here are the regression tests:
https://torpat.ch/13749

Comment 5

[Arthur Edelstein [:arthur]]

I'm reopening this bug, to track work on isolating DOM storage to the URL bar domain (the approach taken by Tor Browser). This approach can break fewer sites than simply banning third-party DOM storage altogether.

Comment 6

[Brad Lassey [:blassey] (use needinfo?)]

bug 536509 seems sufficient for what we needed in e10s, so untracking for e10s

Comment 7

[Jonathan Hao (inactive) [:jhao]]

LocalStorage respects origin attributes and bug 1260931 added first party domain to origin attributes, so it should alread be isolated by first party domain.  We also have a test for that in bug 1264567.  As for session storage, it is already isolated per tabs by design.

I think there's nothing to do in this bug, so I'm closing it.