wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-09 01:08:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

[network] Add additional cookie setting checks.

Browse source 
Added checks for sub-document navigations from cross-site to same-site in
third-party checks when setting a cookie.
This commit is contained in:
Moonchild 2024-07-10 00:22:49 +02:00 • committed by roytam1
commit 9759098329
2 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
netwerk/cookie/CookieServiceChild.cpp
View file

@ -151,6 +151,8 @@ CookieServiceChild::SetCookieStringInternal(nsIURI *aHostURI,
NS_ENSURE_ARG(aHostURI);
NS_ENSURE_ARG_POINTER(aCookieString);
nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
// Fast past: don't bother sending IPC messages about nullprincipal'd
// documents.
nsAutoCString scheme;
@ -163,6 +165,19 @@ CookieServiceChild::SetCookieStringInternal(nsIURI *aHostURI,
if (RequireThirdPartyCheck())
mThirdPartyUtil->IsThirdPartyChannel(aChannel, aHostURI, &isForeign);
// include sub-document navigations from cross-site to same-site
// wrt top-level in our check for thirdparty-ness
if (!isForeign &&
loadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_SUBDOCUMENT) {
bool triggeringPrincipalIsThirdParty = false;
nsCOMPtr<nsIURI> trigURI;
loadInfo->TriggeringPrincipal()->GetURI(getter_AddRefs(trigURI));
mThirdPartyUtil->IsThirdPartyURI(trigURI,
aHostURI,
&triggeringPrincipalIsThirdParty);
isForeign |= triggeringPrincipalIsThirdParty;
}
nsDependentCString cookieString(aCookieString);
nsDependentCString serverTime;
if (aServerTime)

15
netwerk/cookie/nsCookieService.cpp
View file

@ -1967,9 +1967,24 @@ nsCookieService::SetCookieStringCommon(nsIURI *aHostURI,
NS_ENSURE_ARG(aHostURI);
NS_ENSURE_ARG(aCookieHeader);
nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
// Determine whether the request is foreign. Failure is acceptable.
bool isForeign = true;
mThirdPartyUtil->IsThirdPartyChannel(aChannel, aHostURI, &isForeign);
// include sub-document navigations from cross-site to same-site
// wrt top-level in our check for thirdparty-ness
if (!isForeign &&
loadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_SUBDOCUMENT) {
bool triggeringPrincipalIsThirdParty = false;
nsCOMPtr<nsIURI> trigURI;
loadInfo->TriggeringPrincipal()->GetURI(getter_AddRefs(trigURI));
mThirdPartyUtil->IsThirdPartyURI(trigURI,
aHostURI,
&triggeringPrincipalIsThirdParty);
isForeign |= triggeringPrincipalIsThirdParty;
}
// Get originAttributes.
NeckoOriginAttributes attrs;