Closed Bug 1422888 Opened 7 years ago Closed 7 years ago

Investigate clearing of containers not working correctly

Categories

(Firefox :: Security, defect)

defect
Not set
normal

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jkt, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: sec-audit)

I had an issue where web.whatsapp.com didn't clear it's storage after containers were cleared. We should investigate if all storages are being cleared correctly as the website was able to re-auth me after. The alternative to this that the clearing doesn't delete itself correctly in some situations, perhaps race conditions or it throws or something.
Luke and Jonathan to try and reproduce this. One way to reproduce: * Get the build before baku's data clearing patch in https://bugzilla.mozilla.org/show_bug.cgi?id=1419591 * Authenticate to whatsapp in a Container. Then close the whatsapp tab * Then upgrade Nightly. * Go into offline mode * Check what whatsapp site data exists in the browser - cookies, indexeddb, etc - using developer tools.
Flags: needinfo?(lcrouch)
Flags: needinfo?(jkt)
Another way to debug could be by editing the containers JSON file. The following code shouldn't work if the JSON file isn't readable: https://searchfox.org/mozilla-central/source/toolkit/components/contextualidentity/ContextualIdentityService.jsm#145 Edit file a: https://github.com/mozilla/multi-account-containers/wiki/Debugging-containers
Flags: needinfo?(jkt)
Assignee: nobody → jkt
Keywords: sec-audit
Assignee: jkt → nobody
Clearing my needinfo. I wasn't able to reproduce this so I'm not sure that it's consistent?
Flags: needinfo?(lcrouch)
Just a reminder. I want to see if I can reproduce it, and in case, I'll work on it.
Flags: needinfo?(amarchesini)
This might have been a bug in the migration script, which is being removed anyway. We cannot reproduce by creating a container, logging into to whatsapp, deleting that container. When the container is deleted, baku did not find any whatsapp data lying around in the browser. So closing worksforme.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WORKSFORME
Flags: needinfo?(amarchesini)
Group: firefox-core-security
You need to log in before you can comment on or make changes to this bug.