Skip to content

Commit 1276b66

Browse files
leeNleeN
authored
Merge pull request #330 from eleumasc/fix-320-322
Add request URL arguments to network taint operations and target origin argument of window.postMessage taint operations (fixes #320 and #322)
2 parents daed161 + a70c42f commit 1276b66

18 files changed

+262
-47
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,4 +178,4 @@ Additionally, if you get a paper accepted using project Foxhound, we are happy t
178178

179179
We want to thank everybody who contributed to the development of Foxhound!
180180

181-
In no particular order: [tmbrbr](https://github.com/tmbrbr), [leeN](https://github.com/leeN), [saelo](https://github.com/saelo), [soumboussaha](https://github.com/soumboussaha) [LukasHock](https://github.com/LukasHock), [0drai](https://github.com/0drai), [alexbara2000](https://github.com/alexbara2000), [moorts](https://github.com/moorts), [unqrf](https://github.com/unqrf), ..
181+
In no particular order: [tmbrbr](https://github.com/tmbrbr), [leeN](https://github.com/leeN), [saelo](https://github.com/saelo), [soumboussaha](https://github.com/soumboussaha) [LukasHock](https://github.com/LukasHock), [0drai](https://github.com/0drai), [alexbara2000](https://github.com/alexbara2000), [moorts](https://github.com/moorts), [unqrf](https://github.com/unqrf), [eleumasc](https://github.com/eleumasc), ...

‎dom/base/BodyConsumer.cpp‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ NS_IMPL_ISUPPORTS(ConsumeBodyDoneObserver, nsIStreamLoaderObserver)
280280
const nsAString& aBodyLocalPath, const nsACString& aBodyMimeType,
281281
const nsACString& aMixedCaseMimeType,
282282
MutableBlobStorage::MutableBlobStorageType aBlobStorageType,
283-
ErrorResult& aRv) {
283+
const nsACString& aInitialURL, ErrorResult& aRv) {
284284
MOZ_ASSERT(aBodyStream);
285285
MOZ_ASSERT(aMainThreadEventTarget);
286286

@@ -292,7 +292,7 @@ NS_IMPL_ISUPPORTS(ConsumeBodyDoneObserver, nsIStreamLoaderObserver)
292292
RefPtr<BodyConsumer> consumer =
293293
new BodyConsumer(aMainThreadEventTarget, aGlobal, aBodyStream, promise,
294294
aType, aBodyBlobURISpec, aBodyLocalPath, aBodyMimeType,
295-
aMixedCaseMimeType, aBlobStorageType);
295+
aMixedCaseMimeType, aBlobStorageType, aInitialURL);
296296

297297
RefPtr<ThreadSafeWorkerRef> workerRef;
298298

@@ -350,7 +350,8 @@ BodyConsumer::BodyConsumer(
350350
Promise* aPromise, ConsumeType aType, const nsACString& aBodyBlobURISpec,
351351
const nsAString& aBodyLocalPath, const nsACString& aBodyMimeType,
352352
const nsACString& aMixedCaseMimeType,
353-
MutableBlobStorage::MutableBlobStorageType aBlobStorageType)
353+
MutableBlobStorage::MutableBlobStorageType aBlobStorageType,
354+
const nsACString& aInitialURL)
354355
: mTargetThread(NS_GetCurrentThread()),
355356
mMainThreadEventTarget(aMainThreadEventTarget),
356357
mBodyStream(aBodyStream),
@@ -362,6 +363,7 @@ BodyConsumer::BodyConsumer(
362363
mGlobal(aGlobalObject),
363364
mConsumeType(aType),
364365
mConsumePromise(aPromise),
366+
mInitialURL(aInitialURL),
365367
mBodyConsumed(false),
366368
mShuttingDown(false) {
367369
MOZ_ASSERT(aMainThreadEventTarget);
@@ -719,10 +721,12 @@ void BodyConsumer::ContinueConsumeBody(nsresult aStatus, uint32_t aResultLength,
719721
if (NS_SUCCEEDED(
720722
BodyUtil::ConsumeText(aResultLength, resultPtr.get(), decoded))) {
721723
if (mConsumeType == ConsumeType::Text) {
722-
MarkTaintSource(decoded, "fetch.text()");
724+
MarkTaintSource(decoded, "fetch.text()",
725+
NS_ConvertUTF8toUTF16(mInitialURL));
723726
localPromise->MaybeResolve(decoded);
724727
} else {
725-
MarkTaintSource(decoded, "fetch.json()");
728+
MarkTaintSource(decoded, "fetch.json()",
729+
NS_ConvertUTF8toUTF16(mInitialURL));
726730
JS::Rooted<JS::Value> json(cx);
727731
BodyUtil::ConsumeJson(cx, &json, decoded, error);
728732
if (!error.Failed()) {

‎dom/base/BodyConsumer.h‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ class BodyConsumer final : public AbortFollower,
6666
const nsAString& aBodyLocalPath, const nsACString& aBodyMimeType,
6767
const nsACString& aMixedCaseMimeType,
6868
MutableBlobStorage::MutableBlobStorageType aBlobStorageType,
69-
ErrorResult& aRv);
69+
const nsACString& aInitialURL, ErrorResult& aRv);
7070

7171
void ReleaseObject();
7272

@@ -100,7 +100,8 @@ class BodyConsumer final : public AbortFollower,
100100
const nsACString& aBodyBlobURISpec,
101101
const nsAString& aBodyLocalPath, const nsACString& aBodyMimeType,
102102
const nsACString& aMixedCaseMimeType,
103-
MutableBlobStorage::MutableBlobStorageType aBlobStorageType);
103+
MutableBlobStorage::MutableBlobStorageType aBlobStorageType,
104+
const nsACString& aInitialURL);
104105

105106
~BodyConsumer();
106107

@@ -141,6 +142,8 @@ class BodyConsumer final : public AbortFollower,
141142
ConsumeType mConsumeType;
142143
RefPtr<Promise> mConsumePromise;
143144

145+
nsCString mInitialURL;
146+
144147
// touched only on the target thread.
145148
bool mBodyConsumed;
146149

‎dom/base/nsGlobalWindowOuter.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5859,7 +5859,7 @@ void nsGlobalWindowOuter::PostMessageMozOuter(JSContext* aCx,
58595859
scriptLocation, callerAgentClusterId);
58605860

58615861
// Foxhound: window.postMessage sink
5862-
ReportTaintSink(aCx, aMessage, "window.postMessage");
5862+
ReportTaintSink(aCx, aMessage, "window.postMessage", aTargetOrigin);
58635863

58645864
JS::CloneDataPolicy clonePolicy;
58655865

‎dom/fetch/Fetch.cpp‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1465,10 +1465,12 @@ already_AddRefed<Promise> FetchBody<Derived>::ConsumeBody(
14651465
nsCOMPtr<nsIInputStream> bodyStream;
14661466
DerivedClass()->GetBody(getter_AddRefs(bodyStream));
14671467
if (!bodyStream) {
1468+
nsCString initialURL;
1469+
DerivedClass()->GetInitialURL(initialURL);
14681470
RefPtr<EmptyBody> emptyBody =
14691471
EmptyBody::Create(DerivedClass()->GetParentObject(),
14701472
DerivedClass()->GetPrincipalInfo().get(), signalImpl,
1471-
mimeType, mixedCaseMimeType, aRv);
1473+
mimeType, mixedCaseMimeType, initialURL, aRv);
14721474
if (NS_WARN_IF(aRv.Failed())) {
14731475
return nullptr;
14741476
}
@@ -1500,10 +1502,13 @@ already_AddRefed<Promise> FetchBody<Derived>::ConsumeBody(
15001502
blobStorageType = MutableBlobStorage::eCouldBeInTemporaryFile;
15011503
}
15021504

1505+
nsCString initialURL;
1506+
GetInitialURL(initialURL);
1507+
15031508
RefPtr<Promise> promise = BodyConsumer::Create(
15041509
global, mMainThreadEventTarget, bodyStream, signalImpl, aType,
15051510
BodyBlobURISpec(), BodyLocalPath(), mimeType, mixedCaseMimeType,
1506-
blobStorageType, aRv);
1511+
blobStorageType, initialURL, aRv);
15071512
if (NS_WARN_IF(aRv.Failed())) {
15081513
return nullptr;
15091514
}
@@ -1757,6 +1762,17 @@ template void FetchBody<Request>::RunAbortAlgorithm();
17571762

17581763
template void FetchBody<Response>::RunAbortAlgorithm();
17591764

1765+
template <class Derived>
1766+
void FetchBody<Derived>::GetInitialURL(nsACString& aInitialURL) {
1767+
DerivedClass()->GetInitialURL(aInitialURL);
1768+
}
1769+
1770+
template void FetchBody<Request>::GetInitialURL(nsACString& aInitialURL);
1771+
1772+
template void FetchBody<Response>::GetInitialURL(nsACString& aInitialURL);
1773+
1774+
template void FetchBody<EmptyBody>::GetInitialURL(nsACString& aInitialURL);
1775+
17601776
NS_IMPL_ADDREF_INHERITED(EmptyBody, FetchBody<EmptyBody>)
17611777
NS_IMPL_RELEASE_INHERITED(EmptyBody, FetchBody<EmptyBody>)
17621778

@@ -1786,11 +1802,13 @@ EmptyBody::EmptyBody(nsIGlobalObject* aGlobal,
17861802
AbortSignalImpl* aAbortSignalImpl,
17871803
const nsACString& aMimeType,
17881804
const nsACString& aMixedCaseMimeType,
1805+
const nsACString& aInitialURL,
17891806
already_AddRefed<nsIInputStream> aBodyStream)
17901807
: FetchBody<EmptyBody>(aGlobal),
17911808
mAbortSignalImpl(aAbortSignalImpl),
17921809
mMimeType(aMimeType),
17931810
mMixedCaseMimeType(aMixedCaseMimeType),
1811+
mInitialURL(aInitialURL),
17941812
mBodyStream(std::move(aBodyStream)) {
17951813
if (aPrincipalInfo) {
17961814
mPrincipalInfo = MakeUnique<mozilla::ipc::PrincipalInfo>(*aPrincipalInfo);
@@ -1803,7 +1821,8 @@ EmptyBody::~EmptyBody() = default;
18031821
already_AddRefed<EmptyBody> EmptyBody::Create(
18041822
nsIGlobalObject* aGlobal, mozilla::ipc::PrincipalInfo* aPrincipalInfo,
18051823
AbortSignalImpl* aAbortSignalImpl, const nsACString& aMimeType,
1806-
const nsACString& aMixedCaseMimeType, ErrorResult& aRv) {
1824+
const nsACString& aMixedCaseMimeType, const nsACString& aInitialURL,
1825+
ErrorResult& aRv) {
18071826
nsCOMPtr<nsIInputStream> bodyStream;
18081827
aRv = NS_NewCStringInputStream(getter_AddRefs(bodyStream), ""_ns);
18091828
if (NS_WARN_IF(aRv.Failed())) {
@@ -1812,7 +1831,7 @@ already_AddRefed<EmptyBody> EmptyBody::Create(
18121831

18131832
RefPtr<EmptyBody> emptyBody =
18141833
new EmptyBody(aGlobal, aPrincipalInfo, aAbortSignalImpl, aMimeType,
1815-
aMixedCaseMimeType, bodyStream.forget());
1834+
aMixedCaseMimeType, aInitialURL, bodyStream.forget());
18161835
return emptyBody.forget();
18171836
}
18181837

‎dom/fetch/Fetch.h‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,7 @@ class FetchBody : public FetchBodyBase, public AbortFollower {
174174
}
175175

176176
already_AddRefed<ReadableStream> GetBody(JSContext* aCx, ErrorResult& aRv);
177+
177178
void GetMimeType(nsACString& aMimeType, nsACString& aMixedCaseMimeType);
178179

179180
const nsACString& BodyBlobURISpec() const;
@@ -227,6 +228,8 @@ class FetchBody : public FetchBodyBase, public AbortFollower {
227228
BodyConsumer::ConsumeType aType,
228229
ErrorResult& aRv);
229230

231+
void GetInitialURL(nsACString& aInitialURL);
232+
230233
protected:
231234
nsCOMPtr<nsIGlobalObject> mOwner;
232235

@@ -267,7 +270,8 @@ class EmptyBody final : public FetchBody<EmptyBody> {
267270
static already_AddRefed<EmptyBody> Create(
268271
nsIGlobalObject* aGlobal, mozilla::ipc::PrincipalInfo* aPrincipalInfo,
269272
AbortSignalImpl* aAbortSignalImpl, const nsACString& aMimeType,
270-
const nsACString& aMixedCaseMimeType, ErrorResult& aRv);
273+
const nsACString& aMixedCaseMimeType, const nsACString& aInitialURL,
274+
ErrorResult& aRv);
271275

272276
nsIGlobalObject* GetParentObject() const { return mOwner; }
273277

@@ -293,11 +297,15 @@ class EmptyBody final : public FetchBody<EmptyBody> {
293297

294298
const nsAString& BodyLocalPath() const { return EmptyString(); }
295299

300+
using FetchBody::GetInitialURL;
301+
302+
void GetInitialURL(nsACString& aInitialURL) { aInitialURL = mInitialURL; }
303+
296304
private:
297305
EmptyBody(nsIGlobalObject* aGlobal,
298306
mozilla::ipc::PrincipalInfo* aPrincipalInfo,
299307
AbortSignalImpl* aAbortSignalImpl, const nsACString& aMimeType,
300-
const nsACString& aMixedCaseMimeType,
308+
const nsACString& aMixedCaseMimeType, const nsACString& aInitialURL,
301309
already_AddRefed<nsIInputStream> aBodyStream);
302310

303311
~EmptyBody();
@@ -306,8 +314,8 @@ class EmptyBody final : public FetchBody<EmptyBody> {
306314
RefPtr<AbortSignalImpl> mAbortSignalImpl;
307315
nsCString mMimeType;
308316
nsCString mMixedCaseMimeType;
317+
nsCString mInitialURL;
309318
nsCOMPtr<nsIInputStream> mBodyStream;
310-
311319
};
312320
} // namespace dom
313321
} // namespace mozilla

‎dom/fetch/Request.cpp‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -373,6 +373,11 @@ SafeRefPtr<Request> Request::Constructor(
373373
request->SetMethod(outMethod);
374374
}
375375

376+
// Foxhound:
377+
nsCString cUrl;
378+
request->GetURL(cUrl);
379+
nsString url = NS_ConvertUTF8toUTF16(cUrl);
380+
376381
RefPtr<InternalHeaders> requestHeaders = request->Headers();
377382

378383
RefPtr<InternalHeaders> headers;
@@ -387,8 +392,8 @@ SafeRefPtr<Request> Request::Constructor(
387392
nsTArray<InternalHeaders::Entry> headerEntries;
388393
headers->GetEntries(headerEntries);
389394
for(InternalHeaders::Entry entry : headerEntries) {
390-
ReportTaintSink(entry.mName, "fetch.header(key)");
391-
ReportTaintSink(entry.mValue, "fetch.header(value)");
395+
ReportTaintSink(entry.mName, "fetch.header(key)", url);
396+
ReportTaintSink(entry.mValue, "fetch.header(value)", url);
392397
}
393398

394399
} else {
@@ -440,12 +445,9 @@ SafeRefPtr<Request> Request::Constructor(
440445
nsCOMPtr<nsIInputStream> stream;
441446
nsAutoCString contentTypeWithCharset;
442447
uint64_t contentLength = 0;
448+
// Foxhound:
443449
if (bodyInit.IsUSVString()) {
444-
nsAutoCString url;
445-
request->GetURL(url);
446-
nsAutoString aUrl;
447-
CopyUTF8toUTF16(url, aUrl);
448-
ReportTaintSink(bodyInit.GetAsUSVString(), "fetch.body", aUrl);
450+
ReportTaintSink(bodyInit.GetAsUSVString(), "fetch.body", url);
449451
}
450452
aRv = ExtractByteStreamFromBody(bodyInit, getter_AddRefs(stream),
451453
contentTypeWithCharset, contentLength);

‎dom/fetch/Request.h‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,18 @@ class Request final : public FetchBody<Request>, public nsWrapperCache {
127127
AbortSignalImpl* GetSignalImpl() const override;
128128
AbortSignalImpl* GetSignalImplToConsumeBody() const final;
129129

130+
using FetchBody::GetInitialURL;
131+
132+
void GetInitialURL(nsACString& aInitialURL) {
133+
nsTArray<nsCString> aURLList;
134+
mRequest->GetURLListWithoutFragment(aURLList);
135+
if (aURLList.IsEmpty()) {
136+
aInitialURL = EmptyCString();
137+
return;
138+
}
139+
aInitialURL = aURLList[0];
140+
}
141+
130142
private:
131143
~Request();
132144

‎dom/fetch/Response.h‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,18 @@ class Response final : public FetchBody<Response>, public nsWrapperCache {
138138
return mSignalImpl;
139139
}
140140

141+
using FetchBody::GetInitialURL;
142+
143+
void GetInitialURL(nsACString& aInitialURL) {
144+
nsTArray<nsCString> aURLList;
145+
mInternalResponse->GetURLList(aURLList);
146+
if (aURLList.IsEmpty()) {
147+
aInitialURL = EmptyCString();
148+
return;
149+
}
150+
aInitialURL = aURLList[0];
151+
}
152+
141153
private:
142154
static already_AddRefed<Response> CreateAndInitializeAResponse(
143155
const GlobalObject& aGlobal,

‎dom/file/Blob.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ already_AddRefed<Promise> Blob::ConsumeBody(
295295
return BodyConsumer::Create(mGlobal, mainThreadEventTarget, inputStream,
296296
nullptr, aConsumeType, VoidCString(),
297297
VoidString(), VoidCString(), VoidCString(),
298-
MutableBlobStorage::eOnlyInMemory, aRv);
298+
MutableBlobStorage::eOnlyInMemory, VoidCString(), aRv);
299299
}
300300

301301
// https://w3c.github.io/FileAPI/#stream-method-algo

0 commit comments

Comments
 (0)