Closed Bug 1235661 Opened 9 years ago Closed 9 years ago

sync services needs to use origin attributes correctly

Categories

(Firefox :: Security, defect)

defect
Not set
normal

Tracking

()

RESOLVED WONTFIX

People

(Reporter: huseby, Assigned: baku)

References

Details

(Whiteboard: [OA])

Attachments

(1 file, 4 obsolete files)

in the file dom/requestsync/RequestSyncService.jsm there is a call to createCodebasePrincipalFromOrigin that is used to remove the tasks associated with an app: > 172 clearData: function(aData) { > 173 debug('clearData'); > 174 > 175 if (!aData) { > 176 return; > 177 } > 178 > 179 let pattern = JSON.parse(aData); > 180 let dbKeys = []; > 181 > 182 for (let key in this._registrations) { > 183 let prin = Services.scriptSecurityManager.createCodebasePrincipalFromOrigin(key); > 184 if (!ChromeUtils.originAttributesMatchPattern(prin.originAttributes, pattern)) { > 185 continue; > 186 } I'm pretty sure the solution is to populate an origin attribute from the key, then create a GlobalContextOriginAttribute from that to force the user context id to 0 and then call createCodebasePrincipal with the origin attributes instead.
Tanvi, I'm not entire sure what the solution is here. If you look at the code, the comment for the clearData function is: // When an app is uninstalled, we have to clean all its tasks. This suggests to me this is for offline apps. What do you think? If it's for offline apps, I think the correct solution here is to make sure the origin attributes have the user context id set to 0. --dave
Flags: needinfo?(tanvi)
(In reply to Dave Huseby [:huseby] from comment #1) > Tanvi, > > I'm not entire sure what the solution is here. If you look at the code, the > comment for the clearData function is: // When an app is uninstalled, we > have to clean all its tasks. This suggests to me this is for offline apps. > What do you think? If it's for offline apps, I think the correct solution > here is to make sure the origin attributes have the user context id set to 0. > > --dave What is an "app" in this case? A firefoxOS app or something else? firefoxOS apps are likely all using a usercontext of 0. So it shouldn't make a difference if we keep the current origin attributes or force usercontext to 0. If "app" is something Desktop related, we have to learn what it is before we can decide how to treat usercontext. Maybe needinfo someone who has touched this part of the code?
Flags: needinfo?(tanvi)
Attached patch testA.patch (obsolete) (deleted) — Splinter Review
I wrote this API. This API is exposed just to b2g apps.
Attachment #8704114 - Flags: review?(huseby)
Comment on attachment 8704114 [details] [diff] [review] testA.patch Review of attachment 8704114 [details] [diff] [review]: ----------------------------------------------------------------- createGlobalContextOriginAttributes -> createDefaultContextOriginAttributes
Attachment #8704114 - Flags: review?(huseby) → review-
Attached patch bug_1235661.patch (obsolete) (deleted) — Splinter Review
Attachment #8704114 - Attachment is obsolete: true
Attachment #8704567 - Flags: review?(huseby)
Depends on: 1235668
Depends on: 1229222
No longer depends on: 1235668
Attachment #8704567 - Flags: review?(huseby) → review+
Assignee: huseby → amarchesini
Attached patch Bug_1235661.patch (obsolete) (deleted) — Splinter Review
This patch ensures that the origin attributes from the key (origin) is used when doing the origin attributes pattern match.
Attachment #8704567 - Attachment is obsolete: true
Attachment #8734986 - Flags: review?(jonas)
Attached patch Bug_1235661.patch (obsolete) (deleted) — Splinter Review
this builds origin attributes from the key (origin), forces the user context id to 0, then uses the attributes for the pattern match.
Attachment #8734986 - Attachment is obsolete: true
Attachment #8734986 - Flags: review?(jonas)
Attachment #8734987 - Flags: review?(jonas)
Attached patch Bug_1235661.patch (deleted) — Splinter Review
updated patch to have a better commit message.
Attachment #8734987 - Attachment is obsolete: true
Attachment #8734987 - Flags: review?(jonas)
Attachment #8735171 - Flags: review?(jonas)
Comment on attachment 8735171 [details] [diff] [review] Bug_1235661.patch Review of attachment 8735171 [details] [diff] [review]: ----------------------------------------------------------------- This looks wrong. The code seems fine as-is. RequestSync registrations are similar to service-worker registrations and indexedDB. We want that to be separated per-context.
Attachment #8735171 - Flags: review?(jonas) → review-
per jonas' feedback, this patch is no longer needed.
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → WONTFIX
Whiteboard: [OA]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: