Closed
Bug 1422888
Opened 7 years ago
Closed 7 years ago
Investigate clearing of containers not working correctly
Categories
(Firefox :: Security, defect)
Firefox
Security
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jkt, Unassigned)
References
(Blocks 1 open bug)
Details
(Keywords: sec-audit)
I had an issue where web.whatsapp.com didn't clear it's storage after containers were cleared.
We should investigate if all storages are being cleared correctly as the website was able to re-auth me after.
The alternative to this that the clearing doesn't delete itself correctly in some situations, perhaps race conditions or it throws or something.
Comment 1•7 years ago
|
||
Luke and Jonathan to try and reproduce this.
One way to reproduce:
* Get the build before baku's data clearing patch in https://bugzilla.mozilla.org/show_bug.cgi?id=1419591
* Authenticate to whatsapp in a Container. Then close the whatsapp tab
* Then upgrade Nightly.
* Go into offline mode
* Check what whatsapp site data exists in the browser - cookies, indexeddb, etc - using developer tools.
Flags: needinfo?(lcrouch)
Flags: needinfo?(jkt)
Comment 2•7 years ago
|
||
Reporter | ||
Comment 3•7 years ago
|
||
Another way to debug could be by editing the containers JSON file.
The following code shouldn't work if the JSON file isn't readable:
https://searchfox.org/mozilla-central/source/toolkit/components/contextualidentity/ContextualIdentityService.jsm#145
Edit file a: https://github.com/mozilla/multi-account-containers/wiki/Debugging-containers
Flags: needinfo?(jkt)
Updated•7 years ago
|
Assignee: jkt → nobody
Comment 4•7 years ago
|
||
Clearing my needinfo. I wasn't able to reproduce this so I'm not sure that it's consistent?
Flags: needinfo?(lcrouch)
Comment 5•7 years ago
|
||
Just a reminder. I want to see if I can reproduce it, and in case, I'll work on it.
Flags: needinfo?(amarchesini)
Comment 6•7 years ago
|
||
This might have been a bug in the migration script, which is being removed anyway. We cannot reproduce by creating a container, logging into to whatsapp, deleting that container. When the container is deleted, baku did not find any whatsapp data lying around in the browser. So closing worksforme.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
Updated•7 years ago
|
Flags: needinfo?(amarchesini)
Updated•5 years ago
|
Group: firefox-core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•