From d73084cf1946ef837fa181feb2ed6ae1946f076d Mon Sep 17 00:00:00 2001 From: Andrew McCreight Date: Fri, 13 Dec 2024 17:21:21 +0000 Subject: [PATCH] Bug 1275612 - Don't allow any origins to send objects over WebChannel. a=RyanVM The last actual Firefox user of this less-safe feature was removed in 2022. Thunderbird's sync server still needs it, but apparently that is a prototype that isn't really working, so they said it was okay to remove this. Original Revision: https://phabricator.services.mozilla.com/D220646 Differential Revision: https://phabricator.services.mozilla.com/D232089 --- browser/app/profile/firefox.js | 4 -- .../general/browser_remoteTroubleshoot.js | 14 ----- .../test/general/test_remoteTroubleshoot.html | 13 +---- toolkit/actors/WebChannelChild.sys.mjs | 44 +-------------- .../tests/browser/browser_web_channel.js | 54 ++----------------- tools/lint/rejected-words.yml | 3 -- 6 files changed, 8 insertions(+), 124 deletions(-) diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js index 08659afeae68..2156228ae6b5 100644 --- a/browser/app/profile/firefox.js +++ b/browser/app/profile/firefox.js @@ -2427,10 +2427,6 @@ pref("signon.showAutoCompleteFooter", true); pref("signon.showAutoCompleteImport", "import"); pref("signon.suggestImportCount", 3); -// Space separated list of URLS that are allowed to send objects (instead of -// only strings) through webchannels. Bug 1275612 tracks removing this pref and capability. -pref("webchannel.allowObject.urlWhitelist", "https://content.cdn.mozilla.net https://install.mozilla.org"); - // Whether or not the browser should scan for unsubmitted // crash reports, and then show a notification for submitting // those reports. diff --git a/browser/base/content/test/general/browser_remoteTroubleshoot.js b/browser/base/content/test/general/browser_remoteTroubleshoot.js index 55627f0b28e1..0b0389555b80 100644 --- a/browser/base/content/test/general/browser_remoteTroubleshoot.js +++ b/browser/base/content/test/general/browser_remoteTroubleshoot.js @@ -13,9 +13,6 @@ const TEST_URL_TAIL = "example.com/browser/browser/base/content/test/general/test_remoteTroubleshoot.html"; const TEST_URI_GOOD = Services.io.newURI("https://" + TEST_URL_TAIL); const TEST_URI_BAD = Services.io.newURI("http://" + TEST_URL_TAIL); -const TEST_URI_GOOD_OBJECT = Services.io.newURI( - "https://" + TEST_URL_TAIL + "?object" -); // Creates a one-shot web-channel for the test data to be sent back from the test page. function promiseChannelResponse(channelID, originOrPermission) { @@ -116,15 +113,4 @@ add_task(async function () { got.message.errno === 2, "should have failed with errno 2, no such channel" ); - - // Check that the page can send an object as well if it's in the whitelist - let webchannelWhitelistPref = "webchannel.allowObject.urlWhitelist"; - let origWhitelist = Services.prefs.getCharPref(webchannelWhitelistPref); - let newWhitelist = origWhitelist + " https://example.com"; - Services.prefs.setCharPref(webchannelWhitelistPref, newWhitelist); - registerCleanupFunction(() => { - Services.prefs.clearUserPref(webchannelWhitelistPref); - }); - got = await promiseNewChannelResponse(TEST_URI_GOOD_OBJECT); - Assert.ok(got.message, "should have gotten some data back"); }); diff --git a/browser/base/content/test/general/test_remoteTroubleshoot.html b/browser/base/content/test/general/test_remoteTroubleshoot.html index c0c3f5e6049b..5bac98316e37 100644 --- a/browser/base/content/test/general/test_remoteTroubleshoot.html +++ b/browser/base/content/test/general/test_remoteTroubleshoot.html @@ -1,21 +1,12 @@