commit c2b7e89ecaf3ea6a14a650a0a71c6dc3ebb02c50
Author: Arthur Edelstein <arthuredelstein(a)gmail.com>
Date: Tue May 30 10:25:34 2017 -0700
Bug 22343: Make 'Save Page As' obey first-party isolation
Fixes:
* File menu:
- Save Page As
* Context menu in content pages:
- Save Page As
- Save Image As
- Save Video As
- Save Link As
- Save Frame As
* Page Info "Media" Panel:
- Save As
---
browser/base/content/browser.js | 2 +-
browser/base/content/nsContextMenu.js | 39 ++++++++++++++++++--------
browser/base/content/pageinfo/pageInfo.js | 5 ++--
browser/base/content/utilityOverlay.js | 6 ++--
dom/webbrowserpersist/nsIWebBrowserPersist.idl | 9 +++++-
dom/webbrowserpersist/nsWebBrowserPersist.cpp | 18 ++++++++++--
dom/webbrowserpersist/nsWebBrowserPersist.h | 2 ++
mobile/android/chrome/content/browser.js | 6 ++--
netwerk/base/LoadContextInfo.cpp | 18 ++++++++++--
toolkit/components/browser/nsWebBrowser.cpp | 12 ++++++++
toolkit/content/contentAreaUtils.js | 32 +++++++++++++++------
11 files changed, 115 insertions(+), 34 deletions(-)
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 0fc6a72daf66..5eed34e08086 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -6175,7 +6175,7 @@ function handleLinkClick(event, href, linkNode) {
if (where == "save") {
saveURL(href, linkNode ? gatherTextUnder(linkNode) : "", null, true,
- true, doc.documentURIObject, doc);
+ true, doc.documentURIObject, doc, undefined, doc.nodePrincipal);
event.preventDefault();
return true;
}
diff --git a/browser/base/content/nsContextMenu.js b/browser/base/content/nsContextMenu.js
index 368d0475ac34..37ebde22ea07 100644
--- a/browser/base/content/nsContextMenu.js
+++ b/browser/base/content/nsContextMenu.js
@@ -989,9 +989,11 @@ nsContextMenu.prototype = {
let onMessage = (message) => {
mm.removeMessageListener("ContextMenu:SaveVideoFrameAsImage:Result", onMessage);
let dataURL = message.data.dataURL;
+ const principal = Services.scriptSecurityManager.createCodebasePrincipal(
+ makeURI(dataURL), this.principal.originAttributes);
saveImageURL(dataURL, name, "SaveImageTitle", true, false,
document.documentURIObject, null, null, null,
- isPrivate);
+ isPrivate, principal);
};
mm.addMessageListener("ContextMenu:SaveVideoFrameAsImage:Result", onMessage);
},
@@ -1063,7 +1065,7 @@ nsContextMenu.prototype = {
// Helper function to wait for appropriate MIME-type headers and
// then prompt the user with a file picker
saveHelper(linkURL, linkText, dialogTitle, bypassCache, doc, docURI,
- windowID, linkDownload, isContentWindowPrivate) {
+ windowID, linkDownload, isContentWindowPrivate, contentPrincipal) {
// canonical def in nsURILoader.h
const NS_ERROR_SAVE_LINK_AS_TIMEOUT = 0x805d0020;
@@ -1116,7 +1118,7 @@ nsContextMenu.prototype = {
// do it the old fashioned way, which will pick the best filename
// it can without waiting.
saveURL(linkURL, linkText, dialogTitle, bypassCache, false, docURI,
- doc, isContentWindowPrivate);
+ doc, isContentWindowPrivate, contentPrincipal);
}
if (this.extListener)
this.extListener.onStopRequest(aRequest, aContext, aStatusCode);
@@ -1156,10 +1158,13 @@ nsContextMenu.prototype = {
}
};
+ const principal = Services.scriptSecurityManager.createCodebasePrincipal(
+ makeURI(linkURL), this.principal.originAttributes);
+
// setting up a new channel for 'right click - save link as ...'
var channel = NetUtil.newChannel({
uri: makeURI(linkURL),
- loadingPrincipal: this.principal,
+ loadingPrincipal: principal,
contentPolicyType: Ci.nsIContentPolicy.TYPE_SAVEAS_DOWNLOAD,
securityFlags: Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS,
});
@@ -1201,14 +1206,17 @@ nsContextMenu.prototype = {
// Save URL of clicked-on link.
saveLink() {
- urlSecurityCheck(this.linkURL, this.principal);
+ const principal = Services.scriptSecurityManager.createCodebasePrincipal(
+ makeURI(this.linkURL), this.principal.originAttributes);
+ urlSecurityCheck(this.linkURL, principal);
let isContentWindowPrivate = this.isRemote ? this.ownerDoc.isPrivate : undefined;
this.saveHelper(this.linkURL, this.linkTextStr, null, true, this.ownerDoc,
gContextMenuContentData.documentURIObject,
this.frameOuterWindowID,
this.linkDownload,
- isContentWindowPrivate);
+ isContentWindowPrivate,
+ principal);
},
// Backwards-compatibility wrapper
@@ -1223,23 +1231,32 @@ nsContextMenu.prototype = {
let isContentWindowPrivate = this.isRemote ? this.ownerDoc.isPrivate : undefined;
let referrerURI = gContextMenuContentData.documentURIObject;
let isPrivate = PrivateBrowsingUtils.isBrowserPrivate(this.browser);
+ let thisPrincipal = this.principal;
if (this.onCanvas) {
// Bypass cache, since it's a data: URL.
this._canvasToBlobURL(this.target).then(function(blobURL) {
+ const principal = Services.scriptSecurityManager.createCodebasePrincipal(
+ makeURI(blobURL), thisPrincipal.originAttributes);
saveImageURL(blobURL, "canvas.png", "SaveImageTitle",
true, false, referrerURI, null, null, null,
- isPrivate);
+ isPrivate, principal);
}, Cu.reportError);
} else if (this.onImage) {
- urlSecurityCheck(this.mediaURL, this.principal);
+ const principal = Services.scriptSecurityManager.createCodebasePrincipal(
+ makeURI(this.mediaURL), thisPrincipal.originAttributes);
+ urlSecurityCheck(this.mediaURL, principal);
saveImageURL(this.mediaURL, null, "SaveImageTitle", false,
false, referrerURI, null, gContextMenuContentData.contentType,
- gContextMenuContentData.contentDisposition, isPrivate);
+ gContextMenuContentData.contentDisposition, isPrivate,
+ principal);
} else if (this.onVideo || this.onAudio) {
- urlSecurityCheck(this.mediaURL, this.principal);
+ const principal = Services.scriptSecurityManager.createCodebasePrincipal(
+ makeURI(this.mediaURL), thisPrincipal.originAttributes);
+ urlSecurityCheck(this.mediaURL, principal);
var dialogTitle = this.onVideo ? "SaveVideoTitle" : "SaveAudioTitle";
this.saveHelper(this.mediaURL, null, dialogTitle, false, doc, referrerURI,
- this.frameOuterWindowID, "", isContentWindowPrivate);
+ this.frameOuterWindowID, "", isContentWindowPrivate,
+ principal);
}
},
diff --git a/browser/base/content/pageinfo/pageInfo.js b/browser/base/content/pageinfo/pageInfo.js
index 86f548c74494..efe24f7487d9 100644
--- a/browser/base/content/pageinfo/pageInfo.js
+++ b/browser/base/content/pageinfo/pageInfo.js
@@ -696,7 +696,7 @@ function saveMedia() {
titleKey = "SaveAudioTitle";
saveURL(url, null, titleKey, false, false, makeURI(item.baseURI),
- null, gDocInfo.isContentWindowPrivate);
+ null, gDocInfo.isContentWindowPrivate, gDocInfo.principal);
}
} else {
selectSaveFolder(function(aDirectory) {
@@ -704,7 +704,8 @@ function saveMedia() {
var saveAnImage = function(aURIString, aChosenData, aBaseURI) {
uniqueFile(aChosenData.file);
internalSave(aURIString, null, null, null, null, false, "SaveImageTitle",
- aChosenData, aBaseURI, null, false, null, gDocInfo.isContentWindowPrivate);
+ aChosenData, aBaseURI, null, false, null, gDocInfo.isContentWindowPrivate,
+ gDocInfo.principal);
};
for (var i = 0; i < rowArray.length; i++) {
diff --git a/browser/base/content/utilityOverlay.js b/browser/base/content/utilityOverlay.js
index b73a01a0b0f3..4cd7d91e4e9a 100644
--- a/browser/base/content/utilityOverlay.js
+++ b/browser/base/content/utilityOverlay.js
@@ -258,14 +258,16 @@ function openLinkIn(url, where, params) {
// ContentClick.jsm passes isContentWindowPrivate for saveURL instead of passing a CPOW initiatingDoc
if ("isContentWindowPrivate" in params) {
- saveURL(url, null, null, true, true, aNoReferrer ? null : aReferrerURI, null, params.isContentWindowPrivate);
+ saveURL(url, null, null, true, true, aNoReferrer ? null : aReferrerURI,
+ null, params.isContentWindowPrivate,
+ aPrincipal || aTriggeringPrincipal);
} else {
if (!aInitiatingDoc) {
Cu.reportError("openUILink/openLinkIn was called with " +
"where == 'save' but without initiatingDoc. See bug 814264.");
return;
}
- saveURL(url, null, null, true, true, aNoReferrer ? null : aReferrerURI, aInitiatingDoc);
+ saveURL(url, null, null, true, true, aNoReferrer ? null : aReferrerURI, aInitiatingDoc, params.isContentWindowPrivate, aPrincipal || aTriggeringPrincipal);
}
return;
}
diff --git a/dom/webbrowserpersist/nsIWebBrowserPersist.idl b/dom/webbrowserpersist/nsIWebBrowserPersist.idl
index 8de84f5e2904..62ac1c1cd7bd 100644
--- a/dom/webbrowserpersist/nsIWebBrowserPersist.idl
+++ b/dom/webbrowserpersist/nsIWebBrowserPersist.idl
@@ -13,11 +13,12 @@ interface nsIWebProgressListener;
interface nsIFile;
interface nsIChannel;
interface nsILoadContext;
+interface nsIPrincipal;
/**
* Interface for persisting DOM documents and URIs to local or remote storage.
*/
-[scriptable, uuid(8cd752a4-60b1-42c3-a819-65c7a1138a28)]
+[scriptable, uuid(ccdbc750-be09-4f11-bb01-4e0a4db76c41)]
interface nsIWebBrowserPersist : nsICancelable
{
/** No special persistence behaviour. */
@@ -112,6 +113,12 @@ interface nsIWebBrowserPersist : nsICancelable
attribute nsIWebProgressListener progressListener;
/**
+ * This attribute can be used to set the loading principal
+ * of the document or URI to be persisted.
+ */
+ attribute nsIPrincipal loadingPrincipal;
+
+ /**
* Save the specified URI to file.
*
* @param aURI URI to save to file. Some implementations of this interface
diff --git a/dom/webbrowserpersist/nsWebBrowserPersist.cpp b/dom/webbrowserpersist/nsWebBrowserPersist.cpp
index fd6d9d0d9315..4f49b63475f3 100644
--- a/dom/webbrowserpersist/nsWebBrowserPersist.cpp
+++ b/dom/webbrowserpersist/nsWebBrowserPersist.cpp
@@ -277,6 +277,7 @@ const char *kWebBrowserPersistStringBundle =
nsWebBrowserPersist::nsWebBrowserPersist() :
mCurrentDataPathIsRelative(false),
mCurrentThingsToPersist(0),
+ mLoadingPrincipal(nsContentUtils::GetSystemPrincipal()),
mFirstAndOnlyUse(true),
mSavingDocument(false),
mCancel(false),
@@ -413,6 +414,19 @@ NS_IMETHODIMP nsWebBrowserPersist::SetProgressListener(
return NS_OK;
}
+NS_IMETHODIMP nsWebBrowserPersist::GetLoadingPrincipal(nsIPrincipal** loadingPrincipal)
+{
+ *loadingPrincipal = mLoadingPrincipal;
+ return NS_OK;
+}
+
+NS_IMETHODIMP nsWebBrowserPersist::SetLoadingPrincipal(nsIPrincipal* loadingPrincipal)
+{
+ mLoadingPrincipal = loadingPrincipal ? loadingPrincipal :
+ nsContentUtils::GetSystemPrincipal();
+ return NS_OK;
+}
+
NS_IMETHODIMP nsWebBrowserPersist::SaveURI(
nsIURI *aURI, nsISupports *aCacheKey,
nsIURI *aReferrer, uint32_t aReferrerPolicy,
@@ -1385,7 +1399,7 @@ nsresult nsWebBrowserPersist::SaveURIInternal(
nsCOMPtr<nsIChannel> inputChannel;
rv = NS_NewChannel(getter_AddRefs(inputChannel),
aURI,
- nsContentUtils::GetSystemPrincipal(),
+ mLoadingPrincipal,
nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
nsIContentPolicy::TYPE_OTHER,
nullptr, // aPerformanceStorage
@@ -2756,7 +2770,7 @@ nsWebBrowserPersist::CreateChannelFromURI(nsIURI *aURI, nsIChannel **aChannel)
rv = NS_NewChannel(aChannel,
aURI,
- nsContentUtils::GetSystemPrincipal(),
+ mLoadingPrincipal,
nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
nsIContentPolicy::TYPE_OTHER);
NS_ENSURE_SUCCESS(rv, rv);
diff --git a/dom/webbrowserpersist/nsWebBrowserPersist.h b/dom/webbrowserpersist/nsWebBrowserPersist.h
index 17b570d783e7..f95300be12cb 100644
--- a/dom/webbrowserpersist/nsWebBrowserPersist.h
+++ b/dom/webbrowserpersist/nsWebBrowserPersist.h
@@ -147,6 +147,8 @@ private:
nsCOMPtr<nsIMIMEService> mMIMEService;
nsCOMPtr<nsIURI> mURI;
nsCOMPtr<nsIWebProgressListener> mProgressListener;
+ nsCOMPtr<nsIPrincipal> mLoadingPrincipal;
+
/**
* Progress listener for 64-bit values; this is the same object as
* mProgressListener, but is a member to avoid having to qi it for each
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index d081fde9b20e..51fe1422acc5 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -886,10 +886,10 @@ var BrowserApp = {
if (!permissionGranted) {
return;
}
-
+ let doc = aTarget.ownerDocument;
ContentAreaUtils.saveImageURL(aTarget.currentRequestFinalURI.spec, null, "SaveImageTitle",
- false, true, aTarget.ownerDocument.documentURIObject,
- aTarget.ownerDocument);
+ false, true, doc.documentURIObject,
+ null, null, null, doc.isPrivate, doc.nodePrincipal);
});
});
diff --git a/netwerk/base/LoadContextInfo.cpp b/netwerk/base/LoadContextInfo.cpp
index 79f870e8d20d..1218345b63ed 100644
--- a/netwerk/base/LoadContextInfo.cpp
+++ b/netwerk/base/LoadContextInfo.cpp
@@ -121,8 +121,6 @@ GetLoadContextInfo(nsIChannel * aChannel)
{
nsresult rv;
- DebugOnly<bool> pb = NS_UsePrivateBrowsing(aChannel);
-
bool anon = false;
nsLoadFlags loadFlags;
rv = aChannel->GetLoadFlags(&loadFlags);
@@ -132,7 +130,21 @@ GetLoadContextInfo(nsIChannel * aChannel)
OriginAttributes oa;
NS_GetOriginAttributes(aChannel, oa);
- MOZ_ASSERT(pb == (oa.mPrivateBrowsingId > 0));
+
+#ifdef DEBUG
+ nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
+ if (loadInfo) {
+ nsCOMPtr<nsIPrincipal> principal = loadInfo->LoadingPrincipal();
+ if (principal) {
+ bool chrome;
+ principal->GetIsSystemPrincipal(&chrome);
+ if (!chrome) {
+ bool pb = NS_UsePrivateBrowsing(aChannel);
+ MOZ_ASSERT(pb == (oa.mPrivateBrowsingId > 0));
+ }
+ }
+ }
+#endif
return new LoadContextInfo(anon, oa);
}
diff --git a/toolkit/components/browser/nsWebBrowser.cpp b/toolkit/components/browser/nsWebBrowser.cpp
index 40ac82210502..ff1e728243b4 100644
--- a/toolkit/components/browser/nsWebBrowser.cpp
+++ b/toolkit/components/browser/nsWebBrowser.cpp
@@ -997,6 +997,18 @@ nsWebBrowser::SetProgressListener(nsIWebProgressListener* aProgressListener)
}
NS_IMETHODIMP
+nsWebBrowser::GetLoadingPrincipal(nsIPrincipal** loadingPrincipal)
+{
+ return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+nsWebBrowser::SetLoadingPrincipal(nsIPrincipal* loadingPrincipal)
+{
+ return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
nsWebBrowser::SaveURI(nsIURI* aURI,
nsISupports* aCacheKey,
nsIURI* aReferrer,
diff --git a/toolkit/content/contentAreaUtils.js b/toolkit/content/contentAreaUtils.js
index 48cf448798a5..e213a0e4333e 100644
--- a/toolkit/content/contentAreaUtils.js
+++ b/toolkit/content/contentAreaUtils.js
@@ -62,14 +62,14 @@ function forbidCPOW(arg, func, argname) {
// - A linked document using Alt-click Save Link As...
//
function saveURL(aURL, aFileName, aFilePickerTitleKey, aShouldBypassCache,
- aSkipPrompt, aReferrer, aSourceDocument, aIsContentWindowPrivate) {
+ aSkipPrompt, aReferrer, aSourceDocument, aIsContentWindowPrivate,
+ aContentPrincipal) {
forbidCPOW(aURL, "saveURL", "aURL");
forbidCPOW(aReferrer, "saveURL", "aReferrer");
// Allow aSourceDocument to be a CPOW.
-
internalSave(aURL, null, aFileName, null, null, aShouldBypassCache,
aFilePickerTitleKey, null, aReferrer, aSourceDocument,
- aSkipPrompt, null, aIsContentWindowPrivate);
+ aSkipPrompt, null, aIsContentWindowPrivate, aContentPrincipal);
}
// Just like saveURL, but will get some info off the image before
@@ -109,10 +109,12 @@ const nsISupportsCString = Ci.nsISupportsCString;
* @param aIsContentWindowPrivate (bool)
* Whether or not the containing window is in private browsing mode.
* Does not need to be provided is aDoc is passed.
+ * @param aContentPrincipal [optional]
+ * The principal to be used for fetching and saving the target URL.
*/
function saveImageURL(aURL, aFileName, aFilePickerTitleKey, aShouldBypassCache,
aSkipPrompt, aReferrer, aDoc, aContentType, aContentDisp,
- aIsContentWindowPrivate) {
+ aIsContentWindowPrivate, aContentPrincipal) {
forbidCPOW(aURL, "saveImageURL", "aURL");
forbidCPOW(aReferrer, "saveImageURL", "aReferrer");
@@ -156,7 +158,8 @@ function saveImageURL(aURL, aFileName, aFilePickerTitleKey, aShouldBypassCache,
internalSave(aURL, null, aFileName, aContentDisp, aContentType,
aShouldBypassCache, aFilePickerTitleKey, null, aReferrer,
- null, aSkipPrompt, null, aIsContentWindowPrivate);
+ null, aSkipPrompt, null, aIsContentWindowPrivate,
+ aContentPrincipal);
}
// This is like saveDocument, but takes any browser/frame-like element
@@ -170,7 +173,7 @@ function saveBrowser(aBrowser, aSkipPrompt, aOuterWindowID = 0) {
let stack = Components.stack.caller;
persistable.startPersistence(aOuterWindowID, {
onDocumentReady(document) {
- saveDocument(document, aSkipPrompt);
+ saveDocument(document, aSkipPrompt, aBrowser.contentPrincipal);
},
onError(status) {
throw new Components.Exception("saveBrowser failed asynchronously in startPersistence",
@@ -186,7 +189,9 @@ function saveBrowser(aBrowser, aSkipPrompt, aOuterWindowID = 0) {
// case "save as" modes that serialize the document's DOM are
// unavailable. This is a temporary measure for the "Save Frame As"
// command (bug 1141337) and pre-e10s add-ons.
-function saveDocument(aDocument, aSkipPrompt) {
+//
+// aContentPrincipal is the principal for downloading and saving the document.
+function saveDocument(aDocument, aSkipPrompt, aContentPrincipal) {
if (!aDocument)
throw "Must have a document when calling saveDocument";
@@ -241,7 +246,7 @@ function saveDocument(aDocument, aSkipPrompt) {
internalSave(aDocument.documentURI, aDocument, null, contentDisposition,
aDocument.contentType, false, null, null,
aDocument.referrer ? makeURI(aDocument.referrer) : null,
- aDocument, aSkipPrompt, cacheKey);
+ aDocument, aSkipPrompt, cacheKey, undefined, aContentPrincipal);
}
function DownloadListener(win, transfer) {
@@ -350,11 +355,13 @@ XPCOMUtils.defineConstant(this, "kSaveAsType_Text", kSaveAsType_Text);
* This parameter is provided when the aInitiatingDocument is not a
* real document object. Stores whether aInitiatingDocument.defaultView
* was private or not.
+ * @param aContentPrincipal [optional]
+ * The principal to be used for fetching and saving the target URL.
*/
function internalSave(aURL, aDocument, aDefaultFileName, aContentDisposition,
aContentType, aShouldBypassCache, aFilePickerTitleKey,
aChosenData, aReferrer, aInitiatingDocument, aSkipPrompt,
- aCacheKey, aIsContentWindowPrivate) {
+ aCacheKey, aIsContentWindowPrivate, aContentPrincipal) {
forbidCPOW(aURL, "internalSave", "aURL");
forbidCPOW(aReferrer, "internalSave", "aReferrer");
forbidCPOW(aCacheKey, "internalSave", "aCacheKey");
@@ -423,6 +430,7 @@ function internalSave(aURL, aDocument, aDefaultFileName, aContentDisposition,
let nonCPOWDocument =
aDocument && !Cu.isCrossProcessWrapper(aDocument);
+
let isPrivate = aIsContentWindowPrivate;
if (isPrivate === undefined) {
isPrivate = aInitiatingDocument instanceof Ci.nsIDOMDocument
@@ -440,6 +448,7 @@ function internalSave(aURL, aDocument, aDefaultFileName, aContentDisposition,
sourcePostData: nonCPOWDocument ? getPostData(aDocument) : null,
bypassCache: aShouldBypassCache,
isPrivate,
+ loadingPrincipal: aContentPrincipal,
};
// Start the actual save process
@@ -476,10 +485,15 @@ function internalSave(aURL, aDocument, aDefaultFileName, aContentDisposition,
* If true, the document will always be refetched from the server
* @param persistArgs.isPrivate
* Indicates whether this is taking place in a private browsing context.
+ * @param persistArgs.loadingPrincipal
+ * The principal assigned to the document being saved.
*/
function internalPersist(persistArgs) {
var persist = makeWebBrowserPersist();
+ if (["http", "https", "ftp"].includes(persistArgs.sourceURI.scheme)) {
+ persist.loadingPrincipal = persistArgs.loadingPrincipal;
+ }
// Calculate persist flags.
const nsIWBP = Ci.nsIWebBrowserPersist;
const flags = nsIWBP.PERSIST_FLAGS_REPLACE_EXISTING_FILES |
