Open
Bug 1495835
Opened 6 years ago
Updated 2 years ago
PBroadcastChannel can be constructed by a Rogue Content Process with a fraudulent origin
Categories
(Core :: DOM: Core & HTML, enhancement, P3)
Core
DOM: Core & HTML
Tracking
()
NEW
Fission Milestone | Future |
People
(Reporter: tjr, Unassigned)
References
(Depends on 1 open bug, Blocks 1 open bug)
Details
In PBackground.ipdl, PBroadcastChannel accepts a principal and an origin, and uses it to construct an actor which contains the origin as the lookup key. It uses a CheckPrincipalRunnable to verify that the principal supplied matches the origin specified, but a rogue content process could supply a fraudulent pincipal to match the fraudulent origin to pass the check. After this, the content process could receive or send broadcast messages for other origins. The supplied principal should be checked to ensure that the supplied data is valid for this content process.
Updated•6 years ago
|
Priority: -- → P3
Assignee | ||
Updated•6 years ago
|
Component: DOM → DOM: Core & HTML
Updated•2 years ago
|
Severity: normal → S3
You need to log in
before you can comment on or make changes to this bug.
Description
•