Dactyloidae/netwerk/protocol/http
Gaming4JC 30797d4da8 backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins
Potential attack: session supercookie.

[Moz Notes](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c5):
"The problem is that for unknown header names we store the first one we see and then later we case-insensitively match against that name *globally*. That means you can track if a user agent has already seen a certain header name used (by using a different casing and observing whether it gets normalized). This would allow you to see if a user has used a sensitive service that uses custom header names, or allows you to track a user across sites, by teaching the browser about a certain header case once and then observing if different casings get normalized to that.

What we should do instead is only store the casing for a header name for each header list and not globally. That way it only leaks where it's expected (and necessary) to leak."

[Moz fix note](https://bugzilla.mozilla.org/show_bug.cgi?id=1334776#c8):
"nsHttpAtom now holds the old nsHttpAtom and a string that is case sensitive (only for not standard headers).
So nsHttpAtom holds a pointer to a header name. (header names are store on a static structure). This is how it used to be. I left that part the same but added a nsCString which holds a string that was used to resoled the header name. So when we parse headers we call ResolveHeader with a char*. If it is a new header name the char* will be stored in a HttpHeapAtom, nsHttpAtom::_val will point to HttpHeapAtom::value and the same strings will be stored in mLocalCaseSensitiveHeader. For the first resolve request they will be the same but for the following maybe not. At the end this nsHttpAtom will be stored in nsHttpHeaderArray. For all operation we will used the old char* except when we are returning it to a script using VisitHeaders."
2019-02-16 00:14:28 +08:00
..
AltDataOutputStreamChild.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
AltDataOutputStreamChild.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
AltDataOutputStreamParent.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
AltDataOutputStreamParent.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
AlternateServices.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
AlternateServices.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
ASpdySession.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
ASpdySession.h Bug 1322373 - TLS 1.3 early-data for http/2 2019-02-15 23:33:44 +08:00
CacheControlParser.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
CacheControlParser.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
ConnectionDiagnostics.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
http2_huffman_table.txt import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
Http2Compression.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
Http2Compression.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
Http2HuffmanIncoming.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
Http2HuffmanOutgoing.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
Http2Push.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
Http2Push.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
Http2Session.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
Http2Session.h Bug 1322373 - TLS 1.3 early-data for http/2 2019-02-15 23:33:44 +08:00
Http2Stream.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
Http2Stream.h Bug 1416529. r=mcmanus, a=ritu 2019-02-15 23:37:02 +08:00
HttpBaseChannel.cpp backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
HttpBaseChannel.h moebius#158: The Performance Resource Timing (added support for "workerStart") 2019-02-15 23:53:25 +08:00
HttpChannelChild.cpp Remove support and tests for HSTS priming from the tree. Fixes #384 2019-02-15 23:59:39 +08:00
HttpChannelChild.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
HttpChannelParent.cpp Build - throws a warning: 'rv': unreferenced local variable 2019-02-15 23:59:49 +08:00
HttpChannelParent.h Remove support and tests for HSTS priming from the tree. Fixes #384 2019-02-15 23:59:39 +08:00
HttpChannelParentListener.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
HttpChannelParentListener.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
HttpInfo.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
HttpInfo.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
HttpLog.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
InterceptedChannel.cpp moebius#158: The Performance Resource Timing (added support for "workerStart") 2019-02-15 23:53:25 +08:00
InterceptedChannel.h moebius#158: The Performance Resource Timing (added support for "workerStart") 2019-02-15 23:53:25 +08:00
make_incoming_tables.py import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
make_outgoing_tables.py import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
moz.build Remove support and tests for HSTS priming from the tree. Fixes #384 2019-02-15 23:59:39 +08:00
nsAHttpConnection.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsAHttpTransaction.h Bug 1322373 - TLS 1.3 early-data for http/2 2019-02-15 23:33:44 +08:00
nsCORSListenerProxy.cpp Fixed misleading console error message for multiple CORS headers 2019-02-16 00:10:27 +08:00
nsCORSListenerProxy.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttp.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttp.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpActivityDistributor.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpActivityDistributor.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpAtomList.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpAuthCache.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpAuthCache.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpAuthManager.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpAuthManager.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpBasicAuth.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpBasicAuth.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpChannel.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
nsHttpChannel.h Issue #686: Un-deprecate the Application Cache API 2019-02-16 00:10:43 +08:00
nsHttpChannelAuthProvider.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
nsHttpChannelAuthProvider.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpChunkedDecoder.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpChunkedDecoder.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpConnection.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
nsHttpConnection.h DevTools - network - implement the secureConnectionStart property for the PerformanceTiming 2019-02-15 23:34:40 +08:00
nsHttpConnectionInfo.cpp backport mozbug 1444532 - fix a leak in SHA256 in nsHttpConnectionInfo.cpp r=mayhemer 2019-02-16 00:14:27 +08:00
nsHttpConnectionInfo.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpConnectionMgr.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
nsHttpConnectionMgr.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpDigestAuth.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpDigestAuth.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpHandler.cpp Remove all C++ Telemetry Accumulation calls. 2019-02-16 00:12:32 +08:00
nsHttpHandler.h Refresh nsStringBundleService and nsHttpHandler when the browser locale is changed 2019-02-16 00:12:09 +08:00
nsHttpHeaderArray.cpp backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
nsHttpHeaderArray.h backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
nsHttpNTLMAuth.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpNTLMAuth.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpPipeline.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpPipeline.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsHttpRequestHead.cpp backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
nsHttpRequestHead.h backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
nsHttpResponseHead.cpp backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
nsHttpResponseHead.h backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
nsHttpTransaction.cpp Add a null check in nsHttpTransaction::Close. 2019-02-16 00:14:04 +08:00
nsHttpTransaction.h Remove MOZ_WIDGET_GONK [2/2] 2019-02-15 23:57:10 +08:00
nsICorsPreflightCallback.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpActivityObserver.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpAuthenticableChannel.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpAuthenticator.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpAuthManager.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpChannel.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpChannelAuthProvider.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpChannelChild.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpChannelInternal.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpEventSink.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpHeaderVisitor.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
nsIHttpProtocolHandler.idl Revert incorrect UAO optimization that broke SSUAO 2019-02-15 23:57:29 +08:00
nsIWellKnownOpportunisticUtils.idl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
NullHttpChannel.cpp moebius#158: The Performance Resource Timing (added support for "workerStart") 2019-02-15 23:53:25 +08:00
NullHttpChannel.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
NullHttpTransaction.cpp DevTools - network - implement the secureConnectionStart property for the PerformanceTiming 2019-02-15 23:34:40 +08:00
NullHttpTransaction.h DevTools - network - implement the secureConnectionStart property for the PerformanceTiming 2019-02-15 23:34:40 +08:00
PAltDataOutputStream.ipdl import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
PHttpChannel.ipdl Remove support and tests for HSTS priming from the tree. Fixes #384 2019-02-15 23:59:39 +08:00
PHttpChannelParams.h backport mozbug 1334776 - CVE-2017-7797 Header name interning leaks across origins 2019-02-16 00:14:28 +08:00
PSpdyPush.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
README import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
TimingStruct.h DevTools - network - implement the secureConnectionStart property for the PerformanceTiming 2019-02-15 23:34:40 +08:00
TunnelUtils.cpp import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
TunnelUtils.h import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
UserAgentOverrides.jsm Revert incorrect UAO optimization that broke SSUAO 2019-02-15 23:57:29 +08:00
UserAgentUpdates.jsm import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
WellKnownOpportunisticUtils.js import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00
WellKnownOpportunisticUtils.manifest import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo 2018-01-19 03:59:58 +08:00

                                                        Darin Fisher
                                                        darin@netscape.com
                                                        8/8/2001

                            HTTP DESIGN NOTES


CLASS BREAKDOWN

  nsHttpHandler
    - implements nsIProtocolHandler
    - manages preferences
    - owns the authentication cache
    - holds references to frequently used services

  nsHttpChannel
    - implements nsIHttpChannel
    - talks to the cache
    - initiates http transactions
    - processes http response codes
    - intercepts progress notifications

  nsHttpConnection
    - implements nsIStreamListener & nsIStreamProvider
    - talks to the socket transport service
    - feeds data to its transaction object
    - routes progress notifications

  nsHttpConnectionInfo
    - identifies a connection

  nsHttpTransaction
    - implements nsIRequest
    - encapsulates a http request and response
    - parses incoming data

  nsHttpChunkedDecoder
    - owned by a transaction
    - removes chunked decoding

  nsHttpRequestHead
    - owns a nsHttpHeaderArray
    - knows how to fill a request buffer

  nsHttpResponseHead
    - owns a nsHttpHeaderArray
    - knows how to parse response lines
    - performs common header manipulations/calculations

  nsHttpHeaderArray
    - stores http "<header>:<value>" pairs

  nsHttpAuthCache
    - stores authentication credentials for http auth domains

  nsHttpBasicAuth
    - implements nsIHttpAuthenticator
    - generates BASIC auth credentials from user:pass


ATOMS

  nsHttp:: (header namespace)

  eg. nsHttp::Content_Length


TRANSACTION MODEL

  InitiateTransaction -> ActivateConnection -> AsyncWrite, AsyncRead

  The channel creates transactions, and passes them to the handler via
  InitiateTransaction along with a nsHttpConnectionInfo object
  identifying the requested connection.  The handler either dispatches
  the transaction immediately or queues it up to be dispatched later,
  depending on whether or not the limit on the number of connections
  to the requested server has been reached.  Once the transaction can
  be run, the handler looks for an idle connection or creates a new
  connection, and then (re)activates the connection, assigning it the
  new transaction.

  Once activated the connection ensures that it has a socket transport,
  and then calls AsyncWrite and AsyncRead on the socket transport.  This
  begins the process of talking to the server.  To minimize buffering,
  socket transport thread-proxying is completely disabled (using the flags
  DONT_PROXY_LISTENER | DONT_PROXY_PROVIDER | DONT_PROXY_OBSERVER with
  both AsyncWrite and AsyncRead).  This means that the nsHttpConnection's
  OnStartRequest, OnDataAvailable, OnDataWritable, and OnStopRequest
  methods will execute on the socket transport thread.

  The transaction defines (non-virtual) OnDataReadable, OnDataWritable, and
  OnStopTransaction methods, which the connection calls in response to
  its OnDataAvailable, OnDataWritable, and OnStopRequest methods, respectively.
  The transaction owns a nsStreamListenerProxy created by the channel, which
  it uses to transfer data from the socket thread over to the client's thread.
  To mimize buffering, the transaction implements nsIInputStream, and passes
  itself to the stream listener proxy's OnDataAvailable.  In this way, we
  have effectively wedged the response parsing between the socket and the
  thread proxy's buffer.  When read, the transaction turns around and reads
  from the socket using the buffer passed to it.  The transaction scans the
  buffer for headers, removes them as they are detected, and copies the headers
  into its nsHttpResponseHead object.  The rest of the data remains in the
  buffer, and is proxied over to the client's thread to be handled first by the
  http channel and eventually by the client.

  There are several other major design factors, including:

    - transaction cancelation
    - progress notification
    - SSL tunneling
    - chunked decoding
    - thread safety
    - premature EOF detection and transaction restarting
    - pipelining (not yet implemented)


CACHING

<EOF>