916945 - Stop returning cross-origin subframes for named access on Window

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Bobby Holley (:bholley)]

This is similar to bug 916939, but distinct.

The issue is that the browsing context / docshell hierarchy effectively leak window.name cross-origin, even though window.name itself is not available cross-origin. A page can sniff the name of another page by simply embedding that page in a frame and inspecting the named properties object / GSP on the prototype chain of the Window.

This is problematic from a number of angles, including the information flow control stuff that deian has been working on. Let's see if the web breaks when we stop supporting it.

Comment 1

[Bobby Holley (:bholley)]

This doesn't really depend on bug 916939, but I'm marking it as such because I want to get that landed first before doing this.

Comment 2

[Bobby Holley (:bholley)]

Actually, I just realized that this is pretty hard to do, given the linkage between window.name and window.frameElement.getAttribute('name'). We could store these as separate values in the cross-origin case, but that would require some trickery.

The implications for servo here are kind of crappy, but it might not be worth messing with. Thoughts, Boris?

Comment 3

[Boris Zbarsky [:bzbarsky]]

I'm not sure what issue you're worried about...

Comment 4

[Bobby Holley (:bholley)]

Boris and I discussed this on IRC. There are definitely information leaks, but we still may be able to fix the namespace pollution, which is the bigger issue for servo.

Comment 5

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=f3db85ac056f

Comment 6

[Bobby Holley (:bholley)]

Attachment: Stop returning cross-origin subframes for named access in global scope (unless the iframe name matches). v2

I thought of a trick that makes this much more likely to be web-compatible. :-)

Comment 7

[Bobby Holley (:bholley)]

Attachment: Tests. v1

Comment 8

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=3a7d91222a50

Comment 9

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Comment on attachment 807395 [details] [diff] [review]
Stop returning cross-origin subframes for named access in global scope (unless the iframe name matches). v2

Review of attachment 807395 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/base/WindowNamedPropertiesHandler.cpp
@@ +63,5 @@
> +  // computed independently by the parent.
> +  nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aChild);
> +  NS_ENSURE_TRUE(piWin, false);
> +  nsString frameElementName;
> +  piWin->GetFrameElementInternal()->GetAttr(kNameSpaceID_None, nsGkAtoms::name,

No need to null-check?

@@ +64,5 @@
> +  nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aChild);
> +  NS_ENSURE_TRUE(piWin, false);
> +  nsString frameElementName;
> +  piWin->GetFrameElementInternal()->GetAttr(kNameSpaceID_None, nsGkAtoms::name,
> +                                            frameElementName);

AttrValueIs?

Comment 10

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 807395 [details] [diff] [review]
Stop returning cross-origin subframes for named access in global scope (unless the iframe name matches). v2

r=me.  Let's hope...

Comment 11

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 807396 [details] [diff] [review]
Tests. v1

r=me

Comment 12

[Bobby Holley (:bholley)]

Full try push: https://tbpl.mozilla.org/?tree=Try&rev=0461b2964333

Comment 13

[Bobby Holley (:bholley)]

Looks green modulo some android reftest weirdness that KWierso doesn't think is related. Pushing:

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/016fa9293f66
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/eef35ea0291b

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/016fa9293f66
https://hg.mozilla.org/mozilla-central/rev/eef35ea0291b