From 65a588ba17d89fdc89cc84c932368ff9e4a6b9e9 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Wed, 3 Jul 2024 17:03:36 +0200
Subject: [PATCH] Issue #2542 - Part 4: Use BasePrincipal's IsSameOrigin() in
 SecFetch.

---
 dom/security/SecFetch.cpp | 30 ++++++++++++------------------
 1 file changed, 12 insertions(+), 18 deletions(-)

diff --git a/dom/security/SecFetch.cpp b/dom/security/SecFetch.cpp
index 698f2d79a2..2399b44ae7 100644
--- a/dom/security/SecFetch.cpp
+++ b/dom/security/SecFetch.cpp
@@ -105,33 +105,26 @@ bool IsSameOrigin(nsIHttpChannel* aHTTPChannel) {
   nsCOMPtr<nsILoadInfo> loadInfo = aHTTPChannel->GetLoadInfo();
   bool isPrivateWin = loadInfo->GetOriginAttributes().mPrivateBrowsingId > 0;
   
+  bool isSameOrigin = false;
+  nsresult rv = loadInfo->TriggeringPrincipal()->IsSameOrigin(
+      channelURI, isPrivateWin, &isSameOrigin);
+  Unused << NS_WARN_IF(NS_FAILED(rv));
+
   // if the initial request is not same-origin, we can return here
   // because we already know it's not a same-origin request
-  nsAutoCString triggeringOrigin, loadingOrigin, redirectOrigin;
-  
-  nsresult rv = loadInfo->TriggeringPrincipal()->GetOrigin(triggeringOrigin);
-  if NS_FAILED(rv) {
-    // Assume same origin
-    return true;
-  }
-  rv = loadInfo->LoadingPrincipal()->GetOrigin(loadingOrigin);
-  if NS_FAILED(rv) {
-    // Assume same origin
-    return true;
-  }
-  
-  if (triggeringOrigin != loadingOrigin) {
+  if (!isSameOrigin) {
     return false;
   }
 
   // let's further check all the hoops in the redirectChain to
   // ensure all involved redirects are same-origin
+  nsCOMPtr<nsIPrincipal> redirectPrincipal;
   for (nsIPrincipal* principal : loadInfo->RedirectChain()) {
     if (principal) {
-      rv = principal->GetOrigin(redirectOrigin);
-      if NS_FAILED(rv)
-        continue;
-      if (loadingOrigin != redirectOrigin) {
+      rv = redirectPrincipal->IsSameOrigin(channelURI, isPrivateWin,
+                                           &isSameOrigin);
+      Unused << NS_WARN_IF(NS_FAILED(rv));
+      if (!isSameOrigin) {
         return false;
       }
     }
@@ -165,6 +158,7 @@ bool IsSameSite(nsIChannel* aHTTPChannel) {
   // return here because we already know it's not a same-site request
   bool usingHttps = false;
   rv = channelURI->SchemeIs("https", &usingHttps);
+  Unused << NS_WARN_IF(NS_FAILED(rv));
   if (!hostDomain.Equals(channelDomain) || !usingHttps) {
     return false;
   }