From 9759098329c3bf7d8b3fe77956705995373e4eed Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Wed, 10 Jul 2024 00:22:49 +0200
Subject: [PATCH] [network] Add additional cookie setting checks.

Added checks for sub-document navigations from cross-site to same-site in
third-party checks when setting a cookie.
---
 netwerk/cookie/CookieServiceChild.cpp | 15 +++++++++++++++
 netwerk/cookie/nsCookieService.cpp    | 15 +++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/netwerk/cookie/CookieServiceChild.cpp b/netwerk/cookie/CookieServiceChild.cpp
index 9a13b445cf..59def7f0de 100644
--- a/netwerk/cookie/CookieServiceChild.cpp
+++ b/netwerk/cookie/CookieServiceChild.cpp
@@ -151,6 +151,8 @@ CookieServiceChild::SetCookieStringInternal(nsIURI *aHostURI,
   NS_ENSURE_ARG(aHostURI);
   NS_ENSURE_ARG_POINTER(aCookieString);
 
+  nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
+
   // Fast past: don't bother sending IPC messages about nullprincipal'd
   // documents.
   nsAutoCString scheme;
@@ -163,6 +165,19 @@ CookieServiceChild::SetCookieStringInternal(nsIURI *aHostURI,
   if (RequireThirdPartyCheck())
     mThirdPartyUtil->IsThirdPartyChannel(aChannel, aHostURI, &isForeign);
 
+  // include sub-document navigations from cross-site to same-site
+  // wrt top-level in our check for thirdparty-ness
+  if (!isForeign &&
+      loadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_SUBDOCUMENT) {
+    bool triggeringPrincipalIsThirdParty = false;
+    nsCOMPtr<nsIURI> trigURI;
+    loadInfo->TriggeringPrincipal()->GetURI(getter_AddRefs(trigURI));
+    mThirdPartyUtil->IsThirdPartyURI(trigURI,
+                                     aHostURI,
+                                     &triggeringPrincipalIsThirdParty);
+    isForeign |= triggeringPrincipalIsThirdParty;
+  }
+
   nsDependentCString cookieString(aCookieString);
   nsDependentCString serverTime;
   if (aServerTime)
diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp
index 147103afd0..bdcb388373 100644
--- a/netwerk/cookie/nsCookieService.cpp
+++ b/netwerk/cookie/nsCookieService.cpp
@@ -1967,9 +1967,24 @@ nsCookieService::SetCookieStringCommon(nsIURI *aHostURI,
   NS_ENSURE_ARG(aHostURI);
   NS_ENSURE_ARG(aCookieHeader);
 
+  nsCOMPtr<nsILoadInfo> loadInfo = aChannel->GetLoadInfo();
+
   // Determine whether the request is foreign. Failure is acceptable.
   bool isForeign = true;
   mThirdPartyUtil->IsThirdPartyChannel(aChannel, aHostURI, &isForeign);
+  
+  // include sub-document navigations from cross-site to same-site
+  // wrt top-level in our check for thirdparty-ness
+  if (!isForeign &&
+      loadInfo->GetExternalContentPolicyType() == nsIContentPolicy::TYPE_SUBDOCUMENT) {
+    bool triggeringPrincipalIsThirdParty = false;
+    nsCOMPtr<nsIURI> trigURI;
+    loadInfo->TriggeringPrincipal()->GetURI(getter_AddRefs(trigURI));
+    mThirdPartyUtil->IsThirdPartyURI(trigURI,
+                                     aHostURI,
+                                     &triggeringPrincipalIsThirdParty);
+    isForeign |= triggeringPrincipalIsThirdParty;
+  }
 
   // Get originAttributes.
   NeckoOriginAttributes attrs;