From 6979441734d52562895fe030d7604047f498f875 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Sat, 6 Jan 2024 15:29:04 -0600 Subject: [PATCH] Issue #2402 - importScripts should be governed by script-src in Web Workers. https://bugzilla.mozilla.org/show_bug.cgi?id=1322111 Add TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS content policy. Update the Cache API schema to account for new nsIContentPolicy type. --- dom/base/nsContentPolicyUtils.h | 1 + dom/base/nsContentUtils.cpp | 1 + dom/base/nsIContentPolicyBase.idl | 8 ++++++++ dom/cache/DBSchema.cpp | 18 ++++++++++++++++-- dom/fetch/InternalRequest.cpp | 1 + dom/security/nsCSPUtils.cpp | 1 + dom/workers/ScriptLoader.cpp | 17 +++++++++++------ extensions/permissions/nsContentBlocker.cpp | 1 + 8 files changed, 40 insertions(+), 8 deletions(-) diff --git a/dom/base/nsContentPolicyUtils.h b/dom/base/nsContentPolicyUtils.h index 600b24c56b..3984ede544 100644 --- a/dom/base/nsContentPolicyUtils.h +++ b/dom/base/nsContentPolicyUtils.h @@ -135,6 +135,7 @@ NS_CP_ContentTypeName(uint32_t contentType) CASE_RETURN( TYPE_INTERNAL_STYLESHEET ); CASE_RETURN( TYPE_INTERNAL_STYLESHEET_PRELOAD ); CASE_RETURN( TYPE_SAVEAS_DOWNLOAD ); + CASE_RETURN( TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS ); default: return ""; } diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp index b246132de2..db8ea5fed7 100644 --- a/dom/base/nsContentUtils.cpp +++ b/dom/base/nsContentUtils.cpp @@ -8595,6 +8595,7 @@ nsContentUtils::InternalContentPolicyTypeToExternal(nsContentPolicyType aType) case nsIContentPolicy::TYPE_INTERNAL_WORKER: case nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER: case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER: + case nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS: return nsIContentPolicy::TYPE_SCRIPT; case nsIContentPolicy::TYPE_INTERNAL_EMBED: diff --git a/dom/base/nsIContentPolicyBase.idl b/dom/base/nsIContentPolicyBase.idl index 184257d11d..589229cd3d 100644 --- a/dom/base/nsIContentPolicyBase.idl +++ b/dom/base/nsIContentPolicyBase.idl @@ -333,6 +333,14 @@ interface nsIContentPolicyBase : nsISupports */ const nsContentPolicyType TYPE_SAVEAS_DOWNLOAD = 42; + /** + * Indicates an importScripts() inside a worker script. + * + * This will be mapped to TYPE_SCRIPT before being passed to content policy + * implementations. + */ + const nsContentPolicyType TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS = 43; + /* When adding new content types, please update nsContentBlocker, * NS_CP_ContentTypeName, nsCSPContext, CSP_ContentTypeToDirective, * DoContentSecurityChecks, all nsIContentPolicy implementations, the diff --git a/dom/cache/DBSchema.cpp b/dom/cache/DBSchema.cpp index 2025150380..953aacb14e 100644 --- a/dom/cache/DBSchema.cpp +++ b/dom/cache/DBSchema.cpp @@ -34,7 +34,7 @@ namespace db { const int32_t kFirstShippedSchemaVersion = 15; namespace { // Update this whenever the DB schema is changed. -const int32_t kLatestSchemaVersion = 24; +const int32_t kLatestSchemaVersion = 25; // --------- // The following constants define the SQL schema. These are defined in the // same order the SQL should be executed in CreateOrMigrateSchema(). They are @@ -287,7 +287,8 @@ static_assert(nsIContentPolicy::TYPE_INVALID == 0 && nsIContentPolicy::TYPE_INTERNAL_STYLESHEET == 39 && nsIContentPolicy::TYPE_INTERNAL_STYLESHEET_PRELOAD == 40 && nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON == 41 && - nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD == 42, + nsIContentPolicy::TYPE_SAVEAS_DOWNLOAD == 42 && + nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS == 43, "nsContentPolicyType values are as expected"); namespace { @@ -2478,6 +2479,7 @@ nsresult MigrateFrom20To21(mozIStorageConnection* aConn, bool& aRewriteSchema); nsresult MigrateFrom21To22(mozIStorageConnection* aConn, bool& aRewriteSchema); nsresult MigrateFrom22To23(mozIStorageConnection* aConn, bool& aRewriteSchema); nsresult MigrateFrom23To24(mozIStorageConnection* aConn, bool& aRewriteSchema); +nsresult MigrateFrom24To25(mozIStorageConnection* aConn, bool& aRewriteSchema); // Configure migration functions to run for the given starting version. Migration sMigrationList[] = { Migration(15, MigrateFrom15To16), @@ -2489,6 +2491,7 @@ Migration sMigrationList[] = { Migration(21, MigrateFrom21To22), Migration(22, MigrateFrom22To23), Migration(23, MigrateFrom23To24), + Migration(24, MigrateFrom24To25), }; uint32_t sMigrationListLength = sizeof(sMigrationList) / sizeof(Migration); nsresult @@ -3013,6 +3016,17 @@ nsresult MigrateFrom23To24(mozIStorageConnection* aConn, bool& aRewriteSchema) return rv; } +nsresult MigrateFrom24To25(mozIStorageConnection* aConn, bool& aRewriteSchema) +{ + MOZ_ASSERT(!NS_IsMainThread()); + MOZ_DIAGNOSTIC_ASSERT(aConn); + + // The only change between 24 and 25 was a new nsIContentPolicy type. + nsresult rv = aConn->SetSchemaVersion(25); + if (NS_WARN_IF(NS_FAILED(rv))) { return rv; } + return rv; +} + } // anonymous namespace } // namespace db } // namespace cache diff --git a/dom/fetch/InternalRequest.cpp b/dom/fetch/InternalRequest.cpp index 71a5590aae..36df242b46 100644 --- a/dom/fetch/InternalRequest.cpp +++ b/dom/fetch/InternalRequest.cpp @@ -234,6 +234,7 @@ InternalRequest::MapContentPolicyTypeToRequestContext(nsContentPolicyType aConte case nsIContentPolicy::TYPE_INTERNAL_SCRIPT: case nsIContentPolicy::TYPE_INTERNAL_SCRIPT_PRELOAD: case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER: + case nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS: context = RequestContext::Script; break; case nsIContentPolicy::TYPE_INTERNAL_WORKER: diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp index f17faddb70..cb04db315d 100644 --- a/dom/security/nsCSPUtils.cpp +++ b/dom/security/nsCSPUtils.cpp @@ -212,6 +212,7 @@ CSP_ContentTypeToDirective(nsContentPolicyType aType) case nsIContentPolicy::TYPE_SCRIPT: case nsIContentPolicy::TYPE_INTERNAL_SCRIPT: case nsIContentPolicy::TYPE_INTERNAL_SCRIPT_PRELOAD: + case nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS: return nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE; case nsIContentPolicy::TYPE_STYLESHEET: diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp index 758c1660e7..0a9b7207e7 100644 --- a/dom/workers/ScriptLoader.cpp +++ b/dom/workers/ScriptLoader.cpp @@ -112,7 +112,7 @@ ChannelFromScriptURL(nsIPrincipal* principal, const nsAString& aScriptURL, bool aIsMainScript, WorkerScriptType aWorkerScriptType, - nsContentPolicyType aContentPolicyType, + nsContentPolicyType aMainScriptContentPolicyType, nsLoadFlags aLoadFlags, bool aDefaultURIEncoding, nsIChannel** aChannel) @@ -169,6 +169,10 @@ ChannelFromScriptURL(nsIPrincipal* principal, secFlags = nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL; } + nsContentPolicyType contentPolicyType = + aIsMainScript ? aMainScriptContentPolicyType + : nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS; + nsCOMPtr channel; // If we have the document, use it. Unfortunately, for dedicated workers // 'parentDoc' ends up being the parent document, which is not the document @@ -179,7 +183,7 @@ ChannelFromScriptURL(nsIPrincipal* principal, uri, parentDoc, secFlags, - aContentPolicyType, + contentPolicyType, loadGroup, nullptr, // aCallbacks aLoadFlags, @@ -194,7 +198,7 @@ ChannelFromScriptURL(nsIPrincipal* principal, uri, principal, secFlags, - aContentPolicyType, + contentPolicyType, loadGroup, nullptr, // aCallbacks aLoadFlags, @@ -2165,7 +2169,7 @@ ChannelFromScriptURLMainThread(nsIPrincipal* aPrincipal, nsIDocument* aParentDoc, nsILoadGroup* aLoadGroup, const nsAString& aScriptURL, - nsContentPolicyType aContentPolicyType, + nsContentPolicyType aMainScriptContentPolicyType, bool aDefaultURIEncoding, nsIChannel** aChannel) { @@ -2178,8 +2182,9 @@ ChannelFromScriptURLMainThread(nsIPrincipal* aPrincipal, return ChannelFromScriptURL(aPrincipal, aBaseURI, aParentDoc, aLoadGroup, ios, secMan, aScriptURL, true, WorkerScript, - aContentPolicyType, nsIRequest::LOAD_NORMAL, - aDefaultURIEncoding, aChannel); + aMainScriptContentPolicyType, + nsIRequest::LOAD_NORMAL, aDefaultURIEncoding, + aChannel); } nsresult diff --git a/extensions/permissions/nsContentBlocker.cpp b/extensions/permissions/nsContentBlocker.cpp index 391785dc3a..29416090a9 100644 --- a/extensions/permissions/nsContentBlocker.cpp +++ b/extensions/permissions/nsContentBlocker.cpp @@ -67,6 +67,7 @@ static const char *kTypeString[] = { "", // TYPE_INTERNAL_STYLESHEET_PRELOAD "", // TYPE_INTERNAL_IMAGE_FAVICON "saveas_download", + "", // TYPE_INTERNAL_WORKERS_IMPORT_SCRIPTS }; #define NUMBER_OF_TYPES MOZ_ARRAY_LENGTH(kTypeString)