summaryrefslogtreecommitdiffstats
path: root/caps/BasePrincipal.h
blob: c1886646122dfd30e681bbf293b663a71052fc0c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef mozilla_BasePrincipal_h
#define mozilla_BasePrincipal_h

#include <stdint.h>
#include "ErrorList.h"
#include "js/TypeDecls.h"
#include "mozilla/AlreadyAddRefed.h"
#include "mozilla/Assertions.h"
#include "mozilla/OriginAttributes.h"
#include "mozilla/RefPtr.h"
#include "nsAtom.h"
#include "nsIObjectOutputStream.h"
#include "nsIPrincipal.h"
#include "nsJSPrincipals.h"
#include "nsStringFwd.h"
#include "nscore.h"

class ExpandedPrincipal;
class mozIDOMWindow;
class nsIChannel;
class nsIReferrerInfo;
class nsISupports;
class nsIURI;

namespace mozilla {

class JSONWriter;

namespace dom {
enum class ReferrerPolicy : uint8_t;
}

namespace extensions {
class WebExtensionPolicy;
class WebExtensionPolicyCore;
}  // namespace extensions

class BasePrincipal;

// Content principals (and content principals embedded within expanded
// principals) stored in SiteIdentifier are guaranteed to contain only the
// eTLD+1 part of the original domain. This is used to determine whether two
// origins are same-site: if it's possible for two origins to access each other
// (maybe after mutating document.domain), then they must have the same site
// identifier.
class SiteIdentifier {
 public:
  void Init(BasePrincipal* aPrincipal) {
    MOZ_ASSERT(aPrincipal);
    mPrincipal = aPrincipal;
  }

  bool IsInitialized() const { return !!mPrincipal; }

  bool Equals(const SiteIdentifier& aOther) const;

 private:
  friend class ::ExpandedPrincipal;

  BasePrincipal* GetPrincipal() const {
    MOZ_ASSERT(IsInitialized());
    return mPrincipal;
  }

  RefPtr<BasePrincipal> mPrincipal;
};

/*
 * Base class from which all nsIPrincipal implementations inherit. Use this for
 * default implementations and other commonalities between principal
 * implementations.
 *
 * We should merge nsJSPrincipals into this class at some point.
 */
class BasePrincipal : public nsJSPrincipals {
 public:
  // Warning: this enum impacts Principal serialization into JSON format.
  // Only update if you know exactly what you are doing
  enum PrincipalKind {
    eNullPrincipal = 0,
    eContentPrincipal,
    eExpandedPrincipal,
    eSystemPrincipal,
    eKindMax = eSystemPrincipal
  };

  static constexpr char NullPrincipalKey = '0';
  static_assert(eNullPrincipal == 0);
  static constexpr char ContentPrincipalKey = '1';
  static_assert(eContentPrincipal == 1);
  static constexpr char ExpandedPrincipalKey = '2';
  static_assert(eExpandedPrincipal == 2);
  static constexpr char SystemPrincipalKey = '3';
  static_assert(eSystemPrincipal == 3);

  template <typename T>
  bool Is() const {
    return mKind == T::Kind();
  }

  template <typename T>
  T* As() {
    MOZ_ASSERT(Is<T>());
    return static_cast<T*>(this);
  }

  enum DocumentDomainConsideration {
    DontConsiderDocumentDomain,
    ConsiderDocumentDomain
  };
  bool Subsumes(nsIPrincipal* aOther,
                DocumentDomainConsideration aConsideration);

  NS_IMETHOD GetOrigin(nsACString& aOrigin) final;
  NS_IMETHOD GetWebExposedOriginSerialization(nsACString& aOrigin) override;
  NS_IMETHOD GetOriginNoSuffix(nsACString& aOrigin) final;
  NS_IMETHOD Equals(nsIPrincipal* other, bool* _retval) final;
  NS_IMETHOD EqualsConsideringDomain(nsIPrincipal* other, bool* _retval) final;
  NS_IMETHOD EqualsURI(nsIURI* aOtherURI, bool* _retval) override;
  NS_IMETHOD EqualsForPermission(nsIPrincipal* other, bool aExactHost,
                                 bool* _retval) final;
  NS_IMETHOD Subsumes(nsIPrincipal* other, bool* _retval) final;
  NS_IMETHOD SubsumesConsideringDomain(nsIPrincipal* other,
                                       bool* _retval) final;
  NS_IMETHOD SubsumesConsideringDomainIgnoringFPD(nsIPrincipal* other,
                                                  bool* _retval) final;
  NS_IMETHOD CheckMayLoad(nsIURI* uri, bool allowIfInheritsPrincipal) final;
  NS_IMETHOD CheckMayLoadWithReporting(nsIURI* uri,
                                       bool allowIfInheritsPrincipal,
                                       uint64_t innerWindowID) final;
  NS_IMETHOD GetAddonPolicy(extensions::WebExtensionPolicy** aResult) final;
  NS_IMETHOD GetContentScriptAddonPolicy(
      extensions::WebExtensionPolicy** aResult) final;
  NS_IMETHOD GetIsNullPrincipal(bool* aResult) override;
  NS_IMETHOD GetIsContentPrincipal(bool* aResult) override;
  NS_IMETHOD GetIsExpandedPrincipal(bool* aResult) override;
  NS_IMETHOD GetIsSystemPrincipal(bool* aResult) override;
  NS_IMETHOD GetScheme(nsACString& aScheme) override;
  NS_IMETHOD SchemeIs(const char* aScheme, bool* aResult) override;
  NS_IMETHOD IsURIInPrefList(const char* aPref, bool* aResult) override;
  NS_IMETHOD IsURIInList(const nsACString& aList, bool* aResult) override;
  NS_IMETHOD IsContentAccessibleAboutURI(bool* aResult) override;
  NS_IMETHOD IsL10nAllowed(nsIURI* aURI, bool* aResult) override;
  NS_IMETHOD GetAboutModuleFlags(uint32_t* flags) override;
  NS_IMETHOD GetIsAddonOrExpandedAddonPrincipal(bool* aResult) override;
  NS_IMETHOD GetOriginAttributes(JSContext* aCx,
                                 JS::MutableHandle<JS::Value> aVal) final;
  NS_IMETHOD GetAsciiSpec(nsACString& aSpec) override;
  NS_IMETHOD GetSpec(nsACString& aSpec) override;
  NS_IMETHOD GetExposablePrePath(nsACString& aResult) override;
  NS_IMETHOD GetExposableSpec(nsACString& aSpec) override;
  NS_IMETHOD GetHostPort(nsACString& aRes) override;
  NS_IMETHOD GetHost(nsACString& aRes) override;
  NS_IMETHOD GetPrePath(nsACString& aResult) override;
  NS_IMETHOD GetFilePath(nsACString& aResult) override;
  NS_IMETHOD GetOriginSuffix(nsACString& aOriginSuffix) final;
  NS_IMETHOD GetIsIpAddress(bool* aIsIpAddress) override;
  NS_IMETHOD GetIsLocalIpAddress(bool* aIsIpAddress) override;
  NS_IMETHOD GetIsOnion(bool* aIsOnion) override;
  NS_IMETHOD GetUserContextId(uint32_t* aUserContextId) final;
  NS_IMETHOD GetPrivateBrowsingId(uint32_t* aPrivateBrowsingId) final;
  NS_IMETHOD GetSiteOrigin(nsACString& aSiteOrigin) final;
  NS_IMETHOD GetSiteOriginNoSuffix(nsACString& aSiteOrigin) override;
  NS_IMETHOD IsThirdPartyURI(nsIURI* uri, bool* aRes) override;
  NS_IMETHOD IsThirdPartyPrincipal(nsIPrincipal* uri, bool* aRes) override;
  NS_IMETHOD IsThirdPartyChannel(nsIChannel* aChannel, bool* aRes) override;
  NS_IMETHOD GetIsOriginPotentiallyTrustworthy(bool* aResult) override;
  NS_IMETHOD GetIsLoopbackHost(bool* aResult) override;
  NS_IMETHOD IsSameOrigin(nsIURI* aURI, bool* aRes) override;
  NS_IMETHOD GetPrefLightCacheKey(nsIURI* aURI, bool aWithCredentials,
                                  const OriginAttributes& aOriginAttributes,
                                  nsACString& _retval) override;
  NS_IMETHOD HasFirstpartyStorageAccess(mozIDOMWindow* aCheckWindow,
                                        uint32_t* aRejectedReason,
                                        bool* aOutAllowed) override;
  NS_IMETHOD GetAsciiHost(nsACString& aAsciiHost) override;
  NS_IMETHOD GetLocalStorageQuotaKey(nsACString& aRes) override;
  NS_IMETHOD AllowsRelaxStrictFileOriginPolicy(nsIURI* aURI,
                                               bool* aRes) override;
  NS_IMETHOD CreateReferrerInfo(mozilla::dom::ReferrerPolicy aReferrerPolicy,
                                nsIReferrerInfo** _retval) override;
  NS_IMETHOD GetIsScriptAllowedByPolicy(
      bool* aIsScriptAllowedByPolicy) override;
  NS_IMETHOD GetStorageOriginKey(nsACString& aOriginKey) override;

  NS_IMETHOD GetNextSubDomainPrincipal(
      nsIPrincipal** aNextSubDomainPrincipal) override;

  NS_IMETHOD GetPrecursorPrincipal(nsIPrincipal** aPrecursor) override;

  nsresult ToJSON(nsACString& aJSON);
  nsresult ToJSON(JSONWriter& aWriter);
  nsresult WriteJSONProperties(JSONWriter& aWriter);

  static already_AddRefed<BasePrincipal> FromJSON(const nsACString& aJSON);

  // Method to write serializable fields which represent all of the fields to
  // deserialize the principal.
  virtual nsresult WriteJSONInnerProperties(JSONWriter& aWriter);

  virtual bool AddonHasPermission(const nsAtom* aPerm);

  virtual bool IsContentPrincipal() const { return false; };

  static BasePrincipal* Cast(nsIPrincipal* aPrin) {
    return static_cast<BasePrincipal*>(aPrin);
  }

  static BasePrincipal& Cast(nsIPrincipal& aPrin) {
    return *static_cast<BasePrincipal*>(&aPrin);
  }

  static const BasePrincipal* Cast(const nsIPrincipal* aPrin) {
    return static_cast<const BasePrincipal*>(aPrin);
  }

  static const BasePrincipal& Cast(const nsIPrincipal& aPrin) {
    return *static_cast<const BasePrincipal*>(&aPrin);
  }

  static already_AddRefed<BasePrincipal> CreateContentPrincipal(
      const nsACString& aOrigin);

  // This method may not create a content principal in case it's not possible to
  // generate a correct origin from the passed URI. If this happens, a
  // NullPrincipal is returned.
  //
  // If `aInitialDomain` is specified, and a ContentPrincipal is set, it will
  // initially have its domain set to the given value, without re-computing js
  // wrappers. Unlike `SetDomain()` this is safe to do off-main-thread.

  static already_AddRefed<BasePrincipal> CreateContentPrincipal(
      nsIURI* aURI, const OriginAttributes& aAttrs,
      nsIURI* aInitialDomain = nullptr);

  const OriginAttributes& OriginAttributesRef() final {
    return mOriginAttributes;
  }
  extensions::WebExtensionPolicy* AddonPolicy();
  RefPtr<extensions::WebExtensionPolicyCore> AddonPolicyCore();
  uint32_t UserContextId() const { return mOriginAttributes.mUserContextId; }
  uint32_t PrivateBrowsingId() const {
    return mOriginAttributes.mPrivateBrowsingId;
  }

  PrincipalKind Kind() const { return mKind; }

  already_AddRefed<BasePrincipal> CloneForcingOriginAttributes(
      const OriginAttributes& aOriginAttributes);

  // If this is an add-on content script principal, returns its AddonPolicy.
  // Otherwise returns null.
  extensions::WebExtensionPolicy* ContentScriptAddonPolicy();
  RefPtr<extensions::WebExtensionPolicyCore> ContentScriptAddonPolicyCore();

  // Helper to check whether this principal is associated with an addon that
  // allows unprivileged code to load aURI.  aExplicit == true will prevent
  // use of all_urls permission, requiring the domain in its permissions.
  bool AddonAllowsLoad(nsIURI* aURI, bool aExplicit = false);

  // Call these to avoid the cost of virtual dispatch.
  inline bool FastEquals(nsIPrincipal* aOther);
  inline bool FastEqualsConsideringDomain(nsIPrincipal* aOther);
  inline bool FastSubsumes(nsIPrincipal* aOther);
  inline bool FastSubsumesConsideringDomain(nsIPrincipal* aOther);
  inline bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther);
  inline bool FastSubsumesConsideringDomainIgnoringFPD(nsIPrincipal* aOther);

  // Fast way to check whether we have a system principal.
  inline bool IsSystemPrincipal() const;

  // Returns the principal to inherit when a caller with this principal loads
  // the given URI.
  //
  // For most principal types, this returns the principal itself. For expanded
  // principals, it returns the first sub-principal which subsumes the given URI
  // (or, if no URI is given, the last allowlist principal).
  nsIPrincipal* PrincipalToInherit(nsIURI* aRequestedURI = nullptr);

  /* Returns true if this principal's CSP should override a document's CSP for
   * loads that it triggers. Currently true for expanded principals which
   * subsume the document principal, and add-on content principals regardless
   * of whether they subsume the document principal.
   */
  bool OverridesCSP(nsIPrincipal* aDocumentPrincipal);

  uint32_t GetOriginNoSuffixHash() const { return mOriginNoSuffix->hash(); }
  uint32_t GetOriginSuffixHash() const { return mOriginSuffix->hash(); }

  virtual nsresult GetSiteIdentifier(SiteIdentifier& aSite) = 0;

 protected:
  BasePrincipal(PrincipalKind aKind, const nsACString& aOriginNoSuffix,
                const OriginAttributes& aOriginAttributes);
  BasePrincipal(BasePrincipal* aOther,
                const OriginAttributes& aOriginAttributes);

  virtual ~BasePrincipal();

  // Note that this does not check OriginAttributes. Callers that depend on
  // those must call Subsumes instead.
  virtual bool SubsumesInternal(nsIPrincipal* aOther,
                                DocumentDomainConsideration aConsider) = 0;

  // Internal, side-effect-free check to determine whether the concrete
  // principal would allow the load ignoring any common behavior implemented in
  // BasePrincipal::CheckMayLoad.
  //
  // Safe to call from any thread, unlike CheckMayLoad.
  virtual bool MayLoadInternal(nsIURI* aURI) = 0;
  friend class ::ExpandedPrincipal;

  // Helper for implementing CheckMayLoad and CheckMayLoadWithReporting.
  nsresult CheckMayLoadHelper(nsIURI* aURI, bool aAllowIfInheritsPrincipal,
                              bool aReport, uint64_t aInnerWindowID);

  void SetHasExplicitDomain() { mHasExplicitDomain = true; }
  bool GetHasExplicitDomain() { return mHasExplicitDomain; }

  // KeyValT holds a principal subtype-specific key value and the associated
  // parsed value after JSON parsing.
  template <typename SerializedKey>
  struct KeyValT {
    static_assert(sizeof(SerializedKey) == 1,
                  "SerializedKey should be a uint8_t");
    SerializedKey key;
    bool valueWasSerialized;
    nsCString value;
  };

  // Common base class for all Deserializer implementations in concrete
  // subclasses. Subclasses will initialize `mPrincipal` in `Read`, and then
  // calls to `QueryInterface` will QI on the target object.
  class Deserializer : public nsISerializable {
   public:
    NS_DECL_ISUPPORTS
    NS_IMETHOD Write(nsIObjectOutputStream* aStream) override;

   protected:
    virtual ~Deserializer() = default;
    RefPtr<BasePrincipal> mPrincipal;
  };

 private:
  static constexpr Span<const char> JSONEnumKeyStrings[4] = {
      MakeStringSpan("0"),
      MakeStringSpan("1"),
      MakeStringSpan("2"),
      MakeStringSpan("3"),
  };

  static void WriteJSONProperty(JSONWriter& aWriter,
                                const Span<const char>& aKey,
                                const nsCString& aValue);

 protected:
  template <size_t EnumValue>
  static inline constexpr const Span<const char>& JSONEnumKeyString() {
    static_assert(EnumValue < ArrayLength(JSONEnumKeyStrings));
    return JSONEnumKeyStrings[EnumValue];
  }
  template <size_t EnumValue>
  static void WriteJSONProperty(JSONWriter& aWriter, const nsCString& aValue) {
    WriteJSONProperty(aWriter, JSONEnumKeyString<EnumValue>(), aValue);
  }

 private:
  static already_AddRefed<BasePrincipal> CreateContentPrincipal(
      nsIURI* aURI, const OriginAttributes& aAttrs,
      const nsACString& aOriginNoSuffix, nsIURI* aInitialDomain);

  bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther,
                               DocumentDomainConsideration aConsideration);

  const RefPtr<nsAtom> mOriginNoSuffix;
  const RefPtr<nsAtom> mOriginSuffix;

  const OriginAttributes mOriginAttributes;
  const PrincipalKind mKind;
  std::atomic<bool> mHasExplicitDomain;
};

inline bool BasePrincipal::FastEquals(nsIPrincipal* aOther) {
  MOZ_ASSERT(aOther);

  auto other = Cast(aOther);
  if (Kind() != other->Kind()) {
    // Principals of different kinds can't be equal.
    return false;
  }

  // Two principals are considered to be equal if their origins are the same.
  // If the two principals are content principals, their origin attributes
  // (aka the origin suffix) must also match.
  if (Kind() == eSystemPrincipal) {
    return this == other;
  }

  if (Kind() == eContentPrincipal || Kind() == eNullPrincipal) {
    return mOriginNoSuffix == other->mOriginNoSuffix &&
           mOriginSuffix == other->mOriginSuffix;
  }

  MOZ_ASSERT(Kind() == eExpandedPrincipal);
  return mOriginNoSuffix == other->mOriginNoSuffix;
}

inline bool BasePrincipal::FastEqualsConsideringDomain(nsIPrincipal* aOther) {
  MOZ_ASSERT(aOther);

  // If neither of the principals have document.domain set, we use the fast path
  // in Equals().  Otherwise, we fall back to the slow path below.
  auto other = Cast(aOther);
  if (!mHasExplicitDomain && !other->mHasExplicitDomain) {
    return FastEquals(aOther);
  }

  // Principals of different kinds can't be equal.
  if (Kind() != other->Kind()) {
    return false;
  }

  // Only ContentPrincipals should have mHasExplicitDomain set to true, so test
  // that we haven't ended up here instead of FastEquals by mistake.
  MOZ_ASSERT(IsContentPrincipal(),
             "Only content principals can set mHasExplicitDomain");

  return Subsumes(aOther, ConsiderDocumentDomain) &&
         other->Subsumes(this, ConsiderDocumentDomain);
}

inline bool BasePrincipal::FastSubsumes(nsIPrincipal* aOther) {
  MOZ_ASSERT(aOther);

  // If two principals are equal, then they both subsume each other.
  if (FastEquals(aOther)) {
    return true;
  }

  // Otherwise, fall back to the slow path.
  return Subsumes(aOther, DontConsiderDocumentDomain);
}

inline bool BasePrincipal::FastSubsumesConsideringDomain(nsIPrincipal* aOther) {
  MOZ_ASSERT(aOther);

  // If neither of the principals have document.domain set, we hand off to
  // FastSubsumes() which has fast paths for some special cases. Otherwise, we
  // fall back to the slow path below.
  if (!mHasExplicitDomain && !Cast(aOther)->mHasExplicitDomain) {
    return FastSubsumes(aOther);
  }

  return Subsumes(aOther, ConsiderDocumentDomain);
}

inline bool BasePrincipal::FastSubsumesIgnoringFPD(nsIPrincipal* aOther) {
  return FastSubsumesIgnoringFPD(aOther, DontConsiderDocumentDomain);
}

inline bool BasePrincipal::FastSubsumesConsideringDomainIgnoringFPD(
    nsIPrincipal* aOther) {
  return FastSubsumesIgnoringFPD(aOther, ConsiderDocumentDomain);
}

inline bool BasePrincipal::IsSystemPrincipal() const {
  return Kind() == eSystemPrincipal;
}

}  // namespace mozilla

inline bool nsIPrincipal::IsSystemPrincipal() const {
  return mozilla::BasePrincipal::Cast(this)->IsSystemPrincipal();
}

#endif /* mozilla_BasePrincipal_h */