Closed Bug 1554294 Opened 5 years ago Closed 5 years ago

about:logins relative URL gets turned into a file:// URIs and then blocked because it's not chrome-privileged

Categories

(Core :: DOM: Security, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla69
Tracking Status
firefox69 --- fixed

People

(Reporter: jaws, Assigned: jkt)

References

Details

(Whiteboard: [domsecurity-active])

Attachments

(1 file)

While working on bug 1553173, I attempted to use relative file paths to import dependencies in JS modules. The JS module was loaded on an unlinkable about: URI with an absolute chrome: URI. Inside of the JS module, a dependency was imported using a relative path.

import ReflectedFluentElement from "./reflected-fluent-element.js";

but I got the following error when loading the page (about:logins):

Content at about:logins may not load or link to file:///m-c/browser/components/aboutlogins/content/components/reflected-fluent-element.js.

MattN and I expected that CORS would have used the resolved chrome: URI before it was converted to a file: URI, which would remove the security error.

Flags: needinfo?(ckerschb)

:jaws, does it work if you use a fully blown path instead of a realtive URL? e.g. does
import ReflectedFluentElement from "chrome://bla/bla/blareflected-fluent-element.js";
work?

Alternatively, what happens if you remove the "./" from the beginning, does that cause it to be translated to file: under the hood? It might be the case that removing ./ causes translation to chrome:// rather than file://, but I am not entirely sure.

If both of those approaches do not work, then I guess we have to expand the carveout we added within Bug 1551379.

Flags: needinfo?(ckerschb) → needinfo?(jaws)

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #1)

:jaws, does it work if you use a fully blown path instead of a realtive URL? e.g. does
import ReflectedFluentElement from "chrome://bla/bla/blareflected-fluent-element.js";
work?

Yes, the full path works. Though by using the full path, the modules can not be referenced by mochitest-plain tests that are running without chrome privileges.

Alternatively, what happens if you remove the "./" from the beginning, does that cause it to be translated to file: under the hood? It might be the case that removing ./ causes translation to chrome:// rather than file://, but I am not entirely sure.

"bare" module resolution isn't supported yet. Removing the "./" from the beginning results in errors like: "TypeError: Error resolving module specifier: reflected-fluent-element.js"

If both of those approaches do not work, then I guess we have to expand the carveout we added within Bug 1551379.

I don't think this is related to the carveout. I think this is a problem of the order of operations when resolving chrome URIs.

Flags: needinfo?(jaws)
Summary: chrome:// URIs are resolved to file:// URIs before applying CORS → about:logins relative URL gets turned into a file:// URIs and then blocked because it's not chrome-privileged

:jonco, we think there might be a problem how we resolve imported modules. We are not entirely sure where to start. When browsing around we found Bug 1342012 which might be the 'import' we are looking for here as well. If not, could you guide us to the right people to help resolve the problem here?

Flags: needinfo?(jcoppeard)

Probably we just need to change IsInternalURIScheme to also include chrome: like we did in bug 1453559.

Assignee: nobody → jkt
Whiteboard: [domsecurity-active]
Status: NEW → ASSIGNED
Flags: qe-verify-
Priority: -- → P1
Pushed by jkingston@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/3ae87fbf60a5 Adding in chrome as a supported scriptLoader IsInternalURIScheme and adding relative file paths to aboutlogins r=baku,jaws
Flags: needinfo?(jcoppeard)

Backed out changeset 3ae87fbf60a5 (bug 1554294) for failing at browser_deleteLogin.js on a CLOSED TREE.

Backout link: https://hg.mozilla.org/integration/autoland/rev/5cff72743ebc9266a78e4c6a41d17d68ac651326

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&selectedJob=251860133&revision=3ae87fbf60a5c6614d42bf518276cf7788a964de

Log link: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=251860133&repo=autoland&lineNumber=2714

Log snippet:

[task 2019-06-14T10:29:16.596Z] 10:29:16 INFO - TEST-START | browser/components/aboutlogins/tests/browser/browser_deleteLogin.js
[task 2019-06-14T10:29:17.291Z] 10:29:17 INFO - GECKO(2256) | JavaScript error: chrome://browser/content/aboutlogins/aboutLogins.js, line 5: TypeError: Error resolving module specifier: aboutLoginsUtils.js
[task 2019-06-14T10:29:17.319Z] 10:29:17 INFO - GECKO(2256) | console.warn: LoginHelper: "Couldn't parse origin for" "about:logins" ({})
[task 2019-06-14T10:29:17.328Z] 10:29:17 INFO - GECKO(2256) | console.warn: LoginHelper: "Couldn't parse origin for" "about:logins" ({})
[task 2019-06-14T10:29:22.557Z] 10:29:22 INFO - TEST-INFO | started process screentopng
[task 2019-06-14T10:29:23.180Z] 10:29:23 INFO - TEST-INFO | screentopng: exit 0
[task 2019-06-14T10:29:23.180Z] 10:29:23 INFO - Buffered messages logged at 10:29:16
[task 2019-06-14T10:29:23.181Z] 10:29:23 INFO - Entering test bound setup
[task 2019-06-14T10:29:23.182Z] 10:29:23 INFO - Buffered messages logged at 10:29:17
[task 2019-06-14T10:29:23.183Z] 10:29:23 INFO - Console message: [JavaScript Error: "TypeError: Error resolving module specifier: aboutLoginsUtils.js" {file: "chrome://browser/content/aboutlogins/aboutLogins.js" line: 5}]
[task 2019-06-14T10:29:23.184Z] 10:29:23 INFO - Leaving test bound setup
[task 2019-06-14T10:29:23.185Z] 10:29:23 INFO - Entering test bound test_show_logins
[task 2019-06-14T10:29:23.186Z] 10:29:23 INFO - Buffered messages finished
[task 2019-06-14T10:29:23.187Z] 10:29:23 INFO - TEST-UNEXPECTED-FAIL | browser/components/aboutlogins/tests/browser/browser_deleteLogin.js | Uncaught exception - Waiting for logins to be displayed - timed out after 50 tries.
[task 2019-06-14T10:29:23.189Z] 10:29:23 INFO - Leaving test bound test_show_logins
[task 2019-06-14T10:29:23.191Z] 10:29:23 INFO - Entering test bound test_login_item
[task 2019-06-14T10:29:23.192Z] 10:29:23 INFO - Clicking on the first login
[task 2019-06-14T10:29:23.194Z] 10:29:23 INFO - Not taking screenshot here: see the one that was previously logged
[task 2019-06-14T10:29:23.195Z] 10:29:23 INFO - TEST-UNEXPECTED-FAIL | browser/components/aboutlogins/tests/browser/browser_deleteLogin.js | Uncaught exception - TypeError: loginListItem is null
[task 2019-06-14T10:29:23.197Z] 10:29:23 INFO - Leaving test bound test_login_item
[task 2019-06-14T10:29:23.199Z] 10:29:23 INFO - GECKO(2256) | MEMORY STAT | vsize 20974886MB | residentFast 988MB
[task 2019-06-14T10:29:23.202Z] 10:29:23 INFO - TEST-OK | browser/components/aboutlogins/tests/browser/browser_deleteLogin.js | took 6202ms
[task 2019-06-14T10:29:23.203Z] 10:29:23 INFO - checking window state

Flags: needinfo?(jkt)
Pushed by jkingston@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/d44437a4ce51 Adding in chrome as a supported scriptLoader IsInternalURIScheme and adding relative file paths to aboutlogins r=baku,jaws
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla69

Removing ni

Flags: needinfo?(jkt)
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: