1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
|
/* Any copyright is dedicated to the Public Domain.
* http://creativecommons.org/publicdomain/zero/1.0/
*/
var unsecureEmptyURL =
"http://example.org/browser/toolkit/components/antitracking/test/browser/empty.html";
var secureEmptyURL =
"https://example.org/browser/toolkit/components/antitracking/test/browser/empty.html";
var secureAnotherEmptyURL =
"https://example.com/browser/toolkit/components/antitracking/test/browser/empty.html";
var secureURL =
"https://example.com/browser/toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.sjs";
var unsecureURL =
"http://example.com/browser/toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.sjs";
var secureImgURL =
"https://example.com/browser/toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.sjs?image";
var unsecureImgURL =
"http://example.com/browser/toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.sjs?image";
function cleanupHSTS(aPartitionEnabled, aUseSite) {
// Ensure to remove example.com from the HSTS list.
let sss = Cc["@mozilla.org/ssservice;1"].getService(
Ci.nsISiteSecurityService
);
for (let origin of ["example.com", "example.org"]) {
let originAttributes = {};
if (aPartitionEnabled) {
if (aUseSite) {
originAttributes = { partitionKey: `(http,${origin})` };
} else {
originAttributes = { partitionKey: origin };
}
}
sss.resetState(
Ci.nsISiteSecurityService.HEADER_HSTS,
NetUtil.newURI("http://example.com/"),
0,
originAttributes
);
}
}
function promiseTabLoadEvent(aTab, aURL, aFinalURL) {
info("Wait for load tab event");
BrowserTestUtils.loadURI(aTab.linkedBrowser, aURL);
return BrowserTestUtils.browserLoaded(aTab.linkedBrowser, false, aFinalURL);
}
function waitFor(host, type) {
return new Promise(resolve => {
const observer = channel => {
if (
channel instanceof Ci.nsIHttpChannel &&
channel.URI.host === host &&
channel.loadInfo.internalContentPolicyType === type
) {
Services.obs.removeObserver(observer, "http-on-stop-request");
resolve(channel.URI.spec);
}
};
Services.obs.addObserver(observer, "http-on-stop-request");
});
}
add_task(async function() {
for (let networkIsolation of [true, false]) {
for (let partitionPerSite of [true, false]) {
await SpecialPowers.pushPrefEnv({
set: [
["privacy.partition.network_state", networkIsolation],
["privacy.dynamic_firstparty.use_site", partitionPerSite],
["security.mixed_content.upgrade_display_content", false],
],
});
let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser));
// Let's load the secureURL as first-party in order to activate HSTS.
await promiseTabLoadEvent(tab, secureURL, secureURL);
// Let's test HSTS: unsecure -> secure.
await promiseTabLoadEvent(tab, unsecureURL, secureURL);
ok(true, "unsecure -> secure, first-party works!");
// Let's load a first-party.
await promiseTabLoadEvent(tab, unsecureEmptyURL, unsecureEmptyURL);
let finalURL = waitFor(
"example.com",
Ci.nsIContentPolicy.TYPE_INTERNAL_IFRAME
);
await SpecialPowers.spawn(tab.linkedBrowser, [unsecureURL], async url => {
let ifr = content.document.createElement("iframe");
content.document.body.appendChild(ifr);
ifr.src = url;
});
if (networkIsolation) {
is(await finalURL, unsecureURL, "HSTS doesn't work for 3rd parties");
} else {
is(await finalURL, secureURL, "HSTS works for 3rd parties");
}
gBrowser.removeCurrentTab();
cleanupHSTS(networkIsolation, partitionPerSite);
}
}
});
add_task(async function test_subresource() {
for (let networkIsolation of [true, false]) {
for (let partitionPerSite of [true, false]) {
await SpecialPowers.pushPrefEnv({
set: [
["privacy.partition.network_state", networkIsolation],
["privacy.dynamic_firstparty.use_site", partitionPerSite],
["security.mixed_content.upgrade_display_content", false],
],
});
let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser));
// Load a secure page as first party.
await promiseTabLoadEvent(tab, secureEmptyURL, secureEmptyURL);
let loadPromise = waitFor(
"example.com",
Ci.nsIContentPolicy.TYPE_INTERNAL_IMAGE
);
// Load a secure subresource to activate HSTS.
await SpecialPowers.spawn(
tab.linkedBrowser,
[secureImgURL],
async url => {
let ifr = content.document.createElement("img");
content.document.body.appendChild(ifr);
ifr.src = url;
}
);
// Ensure the subresource is loaded.
await loadPromise;
// Reload the secure page as first party.
await promiseTabLoadEvent(tab, secureEmptyURL, secureEmptyURL);
let finalURL = waitFor(
"example.com",
Ci.nsIContentPolicy.TYPE_INTERNAL_IMAGE
);
// Load a unsecure subresource, this should be upgraded to https.
await SpecialPowers.spawn(
tab.linkedBrowser,
[unsecureImgURL],
async url => {
let ifr = content.document.createElement("img");
content.document.body.appendChild(ifr);
ifr.src = url;
}
);
is(await finalURL, secureImgURL, "HSTS works for 3rd parties");
// Load the secure page with a different origin as first party.
await promiseTabLoadEvent(
tab,
secureAnotherEmptyURL,
secureAnotherEmptyURL
);
finalURL = waitFor(
"example.com",
Ci.nsIContentPolicy.TYPE_INTERNAL_IMAGE
);
// Load a unsecure subresource
await SpecialPowers.spawn(
tab.linkedBrowser,
[unsecureImgURL],
async url => {
let ifr = content.document.createElement("img");
content.document.body.appendChild(ifr);
ifr.src = url;
}
);
if (networkIsolation) {
is(await finalURL, unsecureImgURL, "HSTS doesn't work for 3rd parties");
} else {
is(await finalURL, secureImgURL, "HSTS works for 3rd parties");
}
gBrowser.removeCurrentTab();
cleanupHSTS(networkIsolation, partitionPerSite);
}
}
});
|