Closed
Bug 1235929
Opened 9 years ago
Closed 9 years ago
PushRecord needs to use origin attributes when creating a codebase principal
Categories
(Firefox :: Security, defect)
Firefox
Security
Tracking
()
RESOLVED
WONTFIX
People
(Reporter: huseby, Assigned: baku)
References
Details
(Whiteboard: [OA])
Attachments
(1 file, 1 obsolete file)
|
(deleted),
patch
|
huseby
:
review+
|
Details | Diff | Splinter Review |
in the file dom/push/PushRecord.jsm there is a call to createCodebasePrincipalFromOrigin:
> 246 principal = Services.scriptSecurityManager.createCodebasePrincipalFromOrigin(url);
> 247 principals.set(this, principal);
I think we need to change this to a GlobalContextOriginAttribute and call createCodebasePrincipal with the url and the attrs so that we avoid any user context isolation.
|
Assignee | |
Comment 1•9 years ago
|
||
Assignee: huseby → amarchesini
Attachment #8704111 -
Flags: review?(huseby)
|
Reporter | |
Comment 2•9 years ago
|
||
Comment on attachment 8704111 [details] [diff] [review]
patch
Review of attachment 8704111 [details] [diff] [review]:
-----------------------------------------------------------------
createGlobalContextOriginAttributes -> createDefaultContextOriginAttributes
Attachment #8704111 -
Flags: review?(huseby) → review-
|
|
Assignee | |
Comment 3•9 years ago
|
||
Attachment #8704111 -
Attachment is obsolete: true
Attachment #8704564 -
Flags: review?(huseby)
|
|
Reporter | |
Updated•9 years ago
|
Attachment #8704564 -
Flags: review?(huseby) → review+
|
|
Reporter | |
Comment 4•9 years ago
|
||
I don't think this patch is needed.
* The origin attributes are being added as a suffix to the uri here: http://mzl.la/1SlYnXU
* The call to createCodebasePrincipalFromOrigin calls CreateCodebasePrincipal: http://mzl.la/1SlYqD3
* CreateCodebasePrincipal correctly populates the origin attributes from the origin: http://mzl.la/1MqybMH
Resolving as WON'T FIX.
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → WONTFIX
|
|
Reporter | |
Updated•9 years ago
|
Whiteboard: [OA]
You need to log in
before you can comment on or make changes to this bug.
Description
•