Tom Ritter [:tjr] (Back 9/5) Reporter
	Description • 6 years ago

The following IPC Protocols are constructed using a principal from the Content Process, and appear to result in an actor associated with that principal. Ultimately, this means that a rogue Content Process can construct and operate on any of the following Protocols in the context of another origin:

The most concerning of these are
https://searchfox.org/mozilla-central/source/dom/clients/manager/PClientSource.ipdl
https://searchfox.org/mozilla-central/source/dom/clients/manager/PClientHandle.ipdl

which have their own IPC methods attached. 

The result of these seem to correspond to individual operations and do not have additional IPC actions:
https://searchfox.org/mozilla-central/source/dom/clients/manager/PClientHandleOp.ipdl
https://searchfox.org/mozilla-central/source/dom/clients/manager/PClientManagerOp.ipdl
https://searchfox.org/mozilla-central/source/dom/clients/manager/PClientSourceOp.ipdl


When constructing these actors, all of which are contructed through structs in https://searchfox.org/mozilla-central/source/dom/clients/manager/ClientIPCTypes.ipdlh, we should assert that the principal provided is permissible for the content proces suppliying the data.

	Selena Deckelmann :selenamarie :selena
	Comment 1 • 6 years ago

Let me know if this was not the correct component.