diff options
Diffstat (limited to 'dom/security/SecFetch.cpp')
| -rw-r--r-- | dom/security/SecFetch.cpp | 411 |
1 files changed, 411 insertions, 0 deletions
diff --git a/dom/security/SecFetch.cpp b/dom/security/SecFetch.cpp new file mode 100644 index 0000000000..b25cd71016 --- /dev/null +++ b/dom/security/SecFetch.cpp @@ -0,0 +1,411 @@ +/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ +/* vim: set ts=8 sts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +#include "SecFetch.h" +#include "nsIHttpChannel.h" +#include "nsContentUtils.h" +#include "nsIRedirectHistoryEntry.h" +#include "nsIReferrerInfo.h" +#include "mozIThirdPartyUtil.h" +#include "nsMixedContentBlocker.h" +#include "nsNetUtil.h" +#include "mozilla/BasePrincipal.h" +#include "mozilla/StaticPrefs_dom.h" + +// Helper function which maps an internal content policy type +// to the corresponding destination for the context of SecFetch. +nsCString MapInternalContentPolicyTypeToDest(nsContentPolicyType aType) { + switch (aType) { + case nsIContentPolicy::TYPE_OTHER: + return "empty"_ns; + case nsIContentPolicy::TYPE_INTERNAL_SCRIPT: + case nsIContentPolicy::TYPE_INTERNAL_SCRIPT_PRELOAD: + case nsIContentPolicy::TYPE_INTERNAL_MODULE: + case nsIContentPolicy::TYPE_INTERNAL_MODULE_PRELOAD: + case nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS: + case nsIContentPolicy::TYPE_INTERNAL_CHROMEUTILS_COMPILED_SCRIPT: + case nsIContentPolicy::TYPE_INTERNAL_FRAME_MESSAGEMANAGER_SCRIPT: + case nsIContentPolicy::TYPE_SCRIPT: + return "script"_ns; + case nsIContentPolicy::TYPE_INTERNAL_WORKER: + case nsIContentPolicy::TYPE_INTERNAL_WORKER_STATIC_MODULE: + return "worker"_ns; + case nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER: + return "sharedworker"_ns; + case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER: + return "serviceworker"_ns; + case nsIContentPolicy::TYPE_INTERNAL_AUDIOWORKLET: + return "audioworklet"_ns; + case nsIContentPolicy::TYPE_INTERNAL_PAINTWORKLET: + return "paintworklet"_ns; + case nsIContentPolicy::TYPE_IMAGESET: + case nsIContentPolicy::TYPE_INTERNAL_IMAGE: + case nsIContentPolicy::TYPE_INTERNAL_IMAGE_PRELOAD: + case nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON: + case nsIContentPolicy::TYPE_IMAGE: + return "image"_ns; + case nsIContentPolicy::TYPE_STYLESHEET: + case nsIContentPolicy::TYPE_INTERNAL_STYLESHEET: + case nsIContentPolicy::TYPE_INTERNAL_STYLESHEET_PRELOAD: + return "style"_ns; + case nsIContentPolicy::TYPE_OBJECT: + case nsIContentPolicy::TYPE_INTERNAL_OBJECT: + return "object"_ns; + case nsIContentPolicy::TYPE_INTERNAL_EMBED: + return "embed"_ns; + case nsIContentPolicy::TYPE_DOCUMENT: + return "document"_ns; + case nsIContentPolicy::TYPE_SUBDOCUMENT: + case nsIContentPolicy::TYPE_INTERNAL_IFRAME: + return "iframe"_ns; + case nsIContentPolicy::TYPE_INTERNAL_FRAME: + return "frame"_ns; + case nsIContentPolicy::TYPE_PING: + return "empty"_ns; + case nsIContentPolicy::TYPE_XMLHTTPREQUEST: + case nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST: + return "empty"_ns; + case nsIContentPolicy::TYPE_INTERNAL_EVENTSOURCE: + return "empty"_ns; + case nsIContentPolicy::TYPE_OBJECT_SUBREQUEST: + return "empty"_ns; + case nsIContentPolicy::TYPE_DTD: + case nsIContentPolicy::TYPE_INTERNAL_DTD: + case nsIContentPolicy::TYPE_INTERNAL_FORCE_ALLOWED_DTD: + return "empty"_ns; + case nsIContentPolicy::TYPE_FONT: + case nsIContentPolicy::TYPE_INTERNAL_FONT_PRELOAD: + case nsIContentPolicy::TYPE_UA_FONT: + return "font"_ns; + case nsIContentPolicy::TYPE_MEDIA: + return "empty"_ns; + case nsIContentPolicy::TYPE_INTERNAL_AUDIO: + return "audio"_ns; + case nsIContentPolicy::TYPE_INTERNAL_VIDEO: + return "video"_ns; + case nsIContentPolicy::TYPE_INTERNAL_TRACK: + return "track"_ns; + case nsIContentPolicy::TYPE_WEBSOCKET: + return "websocket"_ns; + case nsIContentPolicy::TYPE_CSP_REPORT: + return "report"_ns; + case nsIContentPolicy::TYPE_XSLT: + return "xslt"_ns; + case nsIContentPolicy::TYPE_BEACON: + return "empty"_ns; + case nsIContentPolicy::TYPE_FETCH: + case nsIContentPolicy::TYPE_INTERNAL_FETCH_PRELOAD: + return "empty"_ns; + case nsIContentPolicy::TYPE_WEB_MANIFEST: + return "manifest"_ns; + case nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD: + return "empty"_ns; + case nsIContentPolicy::TYPE_SPECULATIVE: + return "empty"_ns; + case nsIContentPolicy::TYPE_PROXIED_WEBRTC_MEDIA: + return "empty"_ns; + case nsIContentPolicy::TYPE_WEB_IDENTITY: + return "webidentity"_ns; + case nsIContentPolicy::TYPE_WEB_TRANSPORT: + return "webtransport"_ns; + case nsIContentPolicy::TYPE_END: + case nsIContentPolicy::TYPE_INVALID: + break; + // Do not add default: so that compilers can catch the missing case. + } + + MOZ_CRASH("Unhandled nsContentPolicyType value"); +} + +// Helper function to determine if a ExpandedPrincipal is of the same-origin as +// a URI in the sec-fetch context. +void IsExpandedPrincipalSameOrigin( + nsCOMPtr<nsIExpandedPrincipal> aExpandedPrincipal, nsIURI* aURI, + bool* aRes) { + *aRes = false; + for (const auto& principal : aExpandedPrincipal->AllowList()) { + // Ignore extension principals to continue treating + // "moz-extension:"-requests as not "same-origin". + if (!mozilla::BasePrincipal::Cast(principal)->AddonPolicy()) { + // A ExpandedPrincipal usually has at most one ContentPrincipal, so we can + // check IsSameOrigin on it here and return early. + mozilla::BasePrincipal::Cast(principal)->IsSameOrigin(aURI, aRes); + return; + } + } +} + +// Helper function to determine whether a request (including involved +// redirects) is same-origin in the context of SecFetch. +bool IsSameOrigin(nsIHttpChannel* aHTTPChannel) { + nsCOMPtr<nsIURI> channelURI; + NS_GetFinalChannelURI(aHTTPChannel, getter_AddRefs(channelURI)); + + nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->LoadInfo(); + + if (mozilla::BasePrincipal::Cast(loadInfo->TriggeringPrincipal()) + ->AddonPolicy()) { + // If an extension triggered the load that has access to the URI then the + // load is considered as same-origin. + return mozilla::BasePrincipal::Cast(loadInfo->TriggeringPrincipal()) + ->AddonAllowsLoad(channelURI); + } + + bool isSameOrigin = false; + if (nsContentUtils::IsExpandedPrincipal(loadInfo->TriggeringPrincipal())) { + nsCOMPtr<nsIExpandedPrincipal> ep = + do_QueryInterface(loadInfo->TriggeringPrincipal()); + IsExpandedPrincipalSameOrigin(ep, channelURI, &isSameOrigin); + } else { + isSameOrigin = loadInfo->TriggeringPrincipal()->IsSameOrigin(channelURI); + } + + // if the initial request is not same-origin, we can return here + // because we already know it's not a same-origin request + if (!isSameOrigin) { + return false; + } + + // let's further check all the hoops in the redirectChain to + // ensure all involved redirects are same-origin + nsCOMPtr<nsIPrincipal> redirectPrincipal; + for (nsIRedirectHistoryEntry* entry : loadInfo->RedirectChain()) { + entry->GetPrincipal(getter_AddRefs(redirectPrincipal)); + if (redirectPrincipal && !redirectPrincipal->IsSameOrigin(channelURI)) { + return false; + } + } + + // must be a same-origin request + return true; +} + +// Helper function to determine whether a request (including involved +// redirects) is same-site in the context of SecFetch. +bool IsSameSite(nsIChannel* aHTTPChannel) { + nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil = + do_GetService(THIRDPARTYUTIL_CONTRACTID); + if (!thirdPartyUtil) { + return false; + } + + nsAutoCString hostDomain; + nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->LoadInfo(); + nsresult rv = loadInfo->TriggeringPrincipal()->GetBaseDomain(hostDomain); + mozilla::Unused << NS_WARN_IF(NS_FAILED(rv)); + + nsAutoCString channelDomain; + nsCOMPtr<nsIURI> channelURI; + NS_GetFinalChannelURI(aHTTPChannel, getter_AddRefs(channelURI)); + rv = thirdPartyUtil->GetBaseDomain(channelURI, channelDomain); + mozilla::Unused << NS_WARN_IF(NS_FAILED(rv)); + + // if the initial request is not same-site, or not https, we can + // return here because we already know it's not a same-site request + if (!hostDomain.Equals(channelDomain) || + (!loadInfo->TriggeringPrincipal()->SchemeIs("https") && + !nsMixedContentBlocker::IsPotentiallyTrustworthyLoopbackHost( + hostDomain))) { + return false; + } + + // let's further check all the hoops in the redirectChain to + // ensure all involved redirects are same-site and https + nsCOMPtr<nsIPrincipal> redirectPrincipal; + for (nsIRedirectHistoryEntry* entry : loadInfo->RedirectChain()) { + entry->GetPrincipal(getter_AddRefs(redirectPrincipal)); + if (redirectPrincipal) { + redirectPrincipal->GetBaseDomain(hostDomain); + if (!hostDomain.Equals(channelDomain) || + !redirectPrincipal->SchemeIs("https")) { + return false; + } + } + } + + // must be a same-site request + return true; +} + +// Helper function to determine whether a request was triggered +// by the end user in the context of SecFetch. +bool IsUserTriggeredForSecFetchSite(nsIHttpChannel* aHTTPChannel) { + /* + * The goal is to distinguish between "webby" navigations that are controlled + * by a given website (e.g. links, the window.location setter,form + * submissions, etc.), and those that are not (e.g. user interaction with a + * user agent’s address bar, bookmarks, etc). + */ + nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->LoadInfo(); + ExtContentPolicyType contentType = loadInfo->GetExternalContentPolicyType(); + + // A request issued by the browser is always user initiated. + if (loadInfo->TriggeringPrincipal()->IsSystemPrincipal() && + contentType == ExtContentPolicy::TYPE_OTHER) { + return true; + } + + // only requests wich result in type "document" are subject to + // user initiated actions in the context of SecFetch. + if (contentType != ExtContentPolicy::TYPE_DOCUMENT && + contentType != ExtContentPolicy::TYPE_SUBDOCUMENT) { + return false; + } + + // The load is considered user triggered if it was triggered by an external + // application. + if (loadInfo->GetLoadTriggeredFromExternal()) { + return true; + } + + // sec-fetch-site can only be user triggered if the load was user triggered. + if (!loadInfo->GetHasValidUserGestureActivation()) { + return false; + } + + // We can assert that the navigation must be "webby" if the load was triggered + // by a meta refresh. See also Bug 1647128. + if (loadInfo->GetIsMetaRefresh()) { + return false; + } + + // All web requests have a valid "original" referrer set in the + // ReferrerInfo which we can use to determine whether a request + // was triggered by a user or not. + nsCOMPtr<nsIReferrerInfo> referrerInfo = aHTTPChannel->GetReferrerInfo(); + if (referrerInfo) { + nsCOMPtr<nsIURI> originalReferrer; + referrerInfo->GetOriginalReferrer(getter_AddRefs(originalReferrer)); + if (originalReferrer) { + return false; + } + } + + return true; +} + +void mozilla::dom::SecFetch::AddSecFetchDest(nsIHttpChannel* aHTTPChannel) { + nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->LoadInfo(); + nsContentPolicyType contentType = loadInfo->InternalContentPolicyType(); + nsCString dest = MapInternalContentPolicyTypeToDest(contentType); + + nsresult rv = + aHTTPChannel->SetRequestHeader("Sec-Fetch-Dest"_ns, dest, false); + mozilla::Unused << NS_WARN_IF(NS_FAILED(rv)); +} + +void mozilla::dom::SecFetch::AddSecFetchMode(nsIHttpChannel* aHTTPChannel) { + nsAutoCString mode("no-cors"); + + nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->LoadInfo(); + uint32_t securityMode = loadInfo->GetSecurityMode(); + ExtContentPolicyType externalType = loadInfo->GetExternalContentPolicyType(); + + if (securityMode == + nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_INHERITS_SEC_CONTEXT || + securityMode == nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_IS_BLOCKED) { + mode = "same-origin"_ns; + } else if (securityMode == + nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT) { + mode = "cors"_ns; + } else { + // If it's not one of the security modes above, then we ensure it's + // at least one of the others defined in nsILoadInfo + MOZ_ASSERT( + securityMode == + nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_INHERITS_SEC_CONTEXT || + securityMode == + nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, + "unhandled security mode"); + } + + if (externalType == ExtContentPolicy::TYPE_DOCUMENT || + externalType == ExtContentPolicy::TYPE_SUBDOCUMENT || + externalType == ExtContentPolicy::TYPE_OBJECT) { + mode = "navigate"_ns; + } else if (externalType == ExtContentPolicy::TYPE_WEBSOCKET) { + mode = "websocket"_ns; + } + + nsresult rv = + aHTTPChannel->SetRequestHeader("Sec-Fetch-Mode"_ns, mode, false); + mozilla::Unused << NS_WARN_IF(NS_FAILED(rv)); +} + +void mozilla::dom::SecFetch::AddSecFetchSite(nsIHttpChannel* aHTTPChannel) { + nsAutoCString site("same-origin"); + + bool isSameOrigin = IsSameOrigin(aHTTPChannel); + if (!isSameOrigin) { + bool isSameSite = IsSameSite(aHTTPChannel); + if (isSameSite) { + site = "same-site"_ns; + } else { + site = "cross-site"_ns; + } + } + + if (IsUserTriggeredForSecFetchSite(aHTTPChannel)) { + site = "none"_ns; + } + + nsresult rv = + aHTTPChannel->SetRequestHeader("Sec-Fetch-Site"_ns, site, false); + mozilla::Unused << NS_WARN_IF(NS_FAILED(rv)); +} + +void mozilla::dom::SecFetch::AddSecFetchUser(nsIHttpChannel* aHTTPChannel) { + nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->LoadInfo(); + ExtContentPolicyType externalType = loadInfo->GetExternalContentPolicyType(); + + // sec-fetch-user only applies to loads of type document or subdocument + if (externalType != ExtContentPolicy::TYPE_DOCUMENT && + externalType != ExtContentPolicy::TYPE_SUBDOCUMENT) { + return; + } + + // sec-fetch-user only applies if the request is user triggered. + // requests triggered by an external application are considerd user triggered. + if (!loadInfo->GetLoadTriggeredFromExternal() && + !loadInfo->GetHasValidUserGestureActivation()) { + return; + } + + nsAutoCString user("?1"); + nsresult rv = + aHTTPChannel->SetRequestHeader("Sec-Fetch-User"_ns, user, false); + mozilla::Unused << NS_WARN_IF(NS_FAILED(rv)); +} + +void mozilla::dom::SecFetch::AddSecFetchHeader(nsIHttpChannel* aHTTPChannel) { + nsCOMPtr<nsIURI> uri; + nsresult rv = aHTTPChannel->GetURI(getter_AddRefs(uri)); + if (NS_WARN_IF(NS_FAILED(rv))) { + return; + } + + // if we are not dealing with a potentially trustworthy URL, then + // there is nothing to do here + if (!nsMixedContentBlocker::IsPotentiallyTrustworthyOrigin(uri)) { + return; + } + + // If we're dealing with a system XMLHttpRequest or fetch, don't add + // Sec- headers. + nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->LoadInfo(); + if (loadInfo->TriggeringPrincipal()->IsSystemPrincipal()) { + ExtContentPolicy extType = loadInfo->GetExternalContentPolicyType(); + if (extType == ExtContentPolicy::TYPE_FETCH || + extType == ExtContentPolicy::TYPE_XMLHTTPREQUEST) { + return; + } + } + + AddSecFetchDest(aHTTPChannel); + AddSecFetchMode(aHTTPChannel); + AddSecFetchSite(aHTTPChannel); + AddSecFetchUser(aHTTPChannel); +} |