caps/BasePrincipal.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef mozilla_BasePrincipal_h
   8 #define mozilla_BasePrincipal_h
   9
  10 #include "nsJSPrincipals.h"
  11
  12 #include "mozilla/Attributes.h"
  13 #include "mozilla/OriginAttributes.h"
  14
  15 class nsAtom;
  16 class nsIContentSecurityPolicy;
  17 class nsIObjectOutputStream;
  18 class nsIObjectInputStream;
  19 class nsIURI;
  20
  21 class ExpandedPrincipal;
  22
  23 namespace Json {
  24 class Value;
  25 }
  26 namespace mozilla {
  27 namespace dom {
  28 class Document;
  29 }
  30 namespace extensions {
  31 class WebExtensionPolicy;
  32 }
  33
  34 class BasePrincipal;
  35
  36 // Content principals (and content principals embedded within expanded
  37 // principals) stored in SiteIdentifier are guaranteed to contain only the
  38 // eTLD+1 part of the original domain. This is used to determine whether two
  39 // origins are same-site: if it's possible for two origins to access each other
  40 // (maybe after mutating document.domain), then they must have the same site
  41 // identifier.
  42 class SiteIdentifier {
  43  public:
  44   void Init(BasePrincipal* aPrincipal) {
  45     MOZ_ASSERT(aPrincipal);
  46     mPrincipal = aPrincipal;
  47   }
  48
  49   bool IsInitialized() const { return !!mPrincipal; }
  50
  51   bool Equals(const SiteIdentifier& aOther) const;
  52
  53  private:
  54   friend class ::ExpandedPrincipal;
  55
  56   BasePrincipal* GetPrincipal() const {
  57     MOZ_ASSERT(IsInitialized());
  58     return mPrincipal;
  59   }
  60
  61   RefPtr<BasePrincipal> mPrincipal;
  62 };
  63
  64 /*
  65  * Base class from which all nsIPrincipal implementations inherit. Use this for
  66  * default implementations and other commonalities between principal
  67  * implementations.
  68  *
  69  * We should merge nsJSPrincipals into this class at some point.
  70  */
  71 class BasePrincipal : public nsJSPrincipals {
  72  public:
  73   // Warning: this enum impacts Principal serialization into JSON format.
  74   // Only update if you know exactly what you are doing
  75   enum PrincipalKind {
  76     eNullPrincipal = 0,
  77     eContentPrincipal,
  78     eExpandedPrincipal,
  79     eSystemPrincipal,
  80     eKindMax = eSystemPrincipal
  81   };
  82
  83   explicit BasePrincipal(PrincipalKind aKind);
  84
  85   template <typename T>
  86   bool Is() const {
  87     return mKind == T::Kind();
  88   }
  89
  90   template <typename T>
  91   T* As() {
  92     MOZ_ASSERT(Is<T>());
  93     return static_cast<T*>(this);
  94   }
  95
  96   enum DocumentDomainConsideration {
  97     DontConsiderDocumentDomain,
  98     ConsiderDocumentDomain
  99   };
 100   bool Subsumes(nsIPrincipal* aOther,
 101                 DocumentDomainConsideration aConsideration);
 102
 103   NS_IMETHOD GetOrigin(nsACString& aOrigin) final;
 104   NS_IMETHOD GetAsciiOrigin(nsACString& aOrigin) override;
 105   NS_IMETHOD GetOriginNoSuffix(nsACString& aOrigin) final;
 106   NS_IMETHOD Equals(nsIPrincipal* other, bool* _retval) final;
 107   NS_IMETHOD EqualsConsideringDomain(nsIPrincipal* other, bool* _retval) final;
 108   NS_IMETHOD EqualsURI(nsIURI* aOtherURI, bool* _retval) override;
 109   NS_IMETHOD Subsumes(nsIPrincipal* other, bool* _retval) final;
 110   NS_IMETHOD SubsumesConsideringDomain(nsIPrincipal* other,
 111                                        bool* _retval) final;
 112   NS_IMETHOD SubsumesConsideringDomainIgnoringFPD(nsIPrincipal* other,
 113                                                   bool* _retval) final;
 114   NS_IMETHOD CheckMayLoad(nsIURI* uri, bool allowIfInheritsPrincipal) final;
 115   NS_IMETHOD CheckMayLoadWithReporting(nsIURI* uri,
 116                                        bool allowIfInheritsPrincipal,
 117                                        uint64_t innerWindowID) final;
 118   NS_IMETHOD GetAddonPolicy(nsISupports** aResult) final;
 119   NS_IMETHOD GetIsNullPrincipal(bool* aResult) override;
 120   NS_IMETHOD GetIsContentPrincipal(bool* aResult) override;
 121   NS_IMETHOD GetIsExpandedPrincipal(bool* aResult) override;
 122   NS_IMETHOD GetIsSystemPrincipal(bool* aResult) override;
 123   NS_IMETHOD SchemeIs(const char* aScheme, bool* aResult) override;
 124   NS_IMETHOD IsURIInPrefList(const char* aPref, bool* aResult) override;
 125   NS_IMETHOD GetAboutModuleFlags(uint32_t* flags) override;
 126   NS_IMETHOD GetIsAddonOrExpandedAddonPrincipal(bool* aResult) override;
 127   NS_IMETHOD GetOriginAttributes(JSContext* aCx,
 128                                  JS::MutableHandle<JS::Value> aVal) final;
 129   NS_IMETHOD GetAsciiSpec(nsACString& aSpec) override;
 130   NS_IMETHOD GetExposablePrePath(nsACString& aResult) override;
 131   NS_IMETHOD GetHostPort(nsACString& aRes) override;
 132   NS_IMETHOD GetPrepath(nsACString& aResult) override;
 133   NS_IMETHOD GetOriginSuffix(nsACString& aOriginSuffix) final;
 134   NS_IMETHOD GetIsOnion(bool* aIsOnion) override;
 135   NS_IMETHOD GetIsInIsolatedMozBrowserElement(
 136       bool* aIsInIsolatedMozBrowserElement) final;
 137   NS_IMETHOD GetUserContextId(uint32_t* aUserContextId) final;
 138   NS_IMETHOD GetPrivateBrowsingId(uint32_t* aPrivateBrowsingId) final;
 139   NS_IMETHOD GetSiteOrigin(nsACString& aOrigin) override;
 140   NS_IMETHOD IsThirdPartyURI(nsIURI* uri, bool* aRes) override;
 141   NS_IMETHOD IsThirdPartyPrincipal(nsIPrincipal* uri, bool* aRes) override;
 142   NS_IMETHOD GetIsOriginPotentiallyTrustworthy(bool* aResult) override;
 143   NS_IMETHOD IsSameOrigin(nsIURI* aURI, bool aIsPrivateWin,
 144                           bool* aRes) override;
 145
 146   nsresult ToJSON(nsACString& aJSON);
 147   static already_AddRefed<BasePrincipal> FromJSON(const nsACString& aJSON);
 148   // Method populates a passed Json::Value with serializable fields
 149   // which represent all of the fields to deserialize the principal
 150   virtual nsresult PopulateJSONObject(Json::Value& aObject);
 151
 152   virtual bool AddonHasPermission(const nsAtom* aPerm);
 153
 154   virtual bool IsContentPrincipal() const { return false; };
 155
 156   static BasePrincipal* Cast(nsIPrincipal* aPrin) {
 157     return static_cast<BasePrincipal*>(aPrin);
 158   }
 159
 160   static BasePrincipal& Cast(nsIPrincipal& aPrin) {
 161     return *static_cast<BasePrincipal*>(&aPrin);
 162   }
 163
 164   static const BasePrincipal* Cast(const nsIPrincipal* aPrin) {
 165     return static_cast<const BasePrincipal*>(aPrin);
 166   }
 167
 168   static const BasePrincipal& Cast(const nsIPrincipal& aPrin) {
 169     return *static_cast<const BasePrincipal*>(&aPrin);
 170   }
 171
 172   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 173       const nsACString& aOrigin);
 174
 175   // These following method may not create a content principal in case it's
 176   // not possible to generate a correct origin from the passed URI. If this
 177   // happens, a NullPrincipal is returned.
 178
 179   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 180       nsIURI* aURI, const OriginAttributes& aAttrs);
 181
 182   const OriginAttributes& OriginAttributesRef() final {
 183     return mOriginAttributes;
 184   }
 185   extensions::WebExtensionPolicy* AddonPolicy();
 186   uint32_t UserContextId() const { return mOriginAttributes.mUserContextId; }
 187   uint32_t PrivateBrowsingId() const {
 188     return mOriginAttributes.mPrivateBrowsingId;
 189   }
 190   bool IsInIsolatedMozBrowserElement() const {
 191     return mOriginAttributes.mInIsolatedMozBrowser;
 192   }
 193
 194   PrincipalKind Kind() const { return mKind; }
 195
 196   already_AddRefed<BasePrincipal> CloneForcingOriginAttributes(
 197       const OriginAttributes& aOriginAttributes);
 198
 199   // If this is an add-on content script principal, returns its AddonPolicy.
 200   // Otherwise returns null.
 201   extensions::WebExtensionPolicy* ContentScriptAddonPolicy();
 202
 203   // Helper to check whether this principal is associated with an addon that
 204   // allows unprivileged code to load aURI.  aExplicit == true will prevent
 205   // use of all_urls permission, requiring the domain in its permissions.
 206   bool AddonAllowsLoad(nsIURI* aURI, bool aExplicit = false);
 207
 208   // Call these to avoid the cost of virtual dispatch.
 209   inline bool FastEquals(nsIPrincipal* aOther);
 210   inline bool FastEqualsConsideringDomain(nsIPrincipal* aOther);
 211   inline bool FastSubsumes(nsIPrincipal* aOther);
 212   inline bool FastSubsumesConsideringDomain(nsIPrincipal* aOther);
 213   inline bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther);
 214   inline bool FastSubsumesConsideringDomainIgnoringFPD(nsIPrincipal* aOther);
 215
 216   // Fast way to check whether we have a system principal.
 217   inline bool IsSystemPrincipal() const;
 218
 219   // Returns the principal to inherit when a caller with this principal loads
 220   // the given URI.
 221   //
 222   // For most principal types, this returns the principal itself. For expanded
 223   // principals, it returns the first sub-principal which subsumes the given URI
 224   // (or, if no URI is given, the last allowlist principal).
 225   nsIPrincipal* PrincipalToInherit(nsIURI* aRequestedURI = nullptr);
 226
 227   /* Returns true if this principal's CSP should override a document's CSP for
 228    * loads that it triggers. Currently true for expanded principals which
 229    * subsume the document principal, and add-on content principals regardless
 230    * of whether they subsume the document principal.
 231    */
 232   bool OverridesCSP(nsIPrincipal* aDocumentPrincipal) {
 233     MOZ_ASSERT(aDocumentPrincipal);
 234
 235     // Expanded principals override CSP if and only if they subsume the document
 236     // principal.
 237     if (mKind == eExpandedPrincipal) {
 238       return FastSubsumes(aDocumentPrincipal);
 239     }
 240     // Extension principals always override the CSP non-extension principals.
 241     // This is primarily for the sake of their stylesheets, which are usually
 242     // loaded from channels and cannot have expanded principals.
 243     return (AddonPolicy() &&
 244             !BasePrincipal::Cast(aDocumentPrincipal)->AddonPolicy());
 245   }
 246
 247   uint32_t GetOriginNoSuffixHash() const { return mOriginNoSuffix->hash(); }
 248   uint32_t GetOriginSuffixHash() const { return mOriginSuffix->hash(); }
 249
 250   virtual nsresult GetSiteIdentifier(SiteIdentifier& aSite) = 0;
 251
 252  protected:
 253   virtual ~BasePrincipal();
 254
 255   // Note that this does not check OriginAttributes. Callers that depend on
 256   // those must call Subsumes instead.
 257   virtual bool SubsumesInternal(nsIPrincipal* aOther,
 258                                 DocumentDomainConsideration aConsider) = 0;
 259
 260   // Internal, side-effect-free check to determine whether the concrete
 261   // principal would allow the load ignoring any common behavior implemented in
 262   // BasePrincipal::CheckMayLoad.
 263   virtual bool MayLoadInternal(nsIURI* aURI) = 0;
 264   friend class ::ExpandedPrincipal;
 265
 266   // Helper for implementing CheckMayLoad and CheckMayLoadWithReporting.
 267   nsresult CheckMayLoadHelper(nsIURI* aURI, bool aAllowIfInheritsPrincipal,
 268                               bool aReport, uint64_t aInnerWindowID);
 269
 270   void SetHasExplicitDomain() { mHasExplicitDomain = true; }
 271
 272   // Either of these functions should be called as the last step of the
 273   // initialization of the principal objects.  It's typically called as the
 274   // last step from the Init() method of the child classes.
 275   void FinishInit(const nsACString& aOriginNoSuffix,
 276                   const OriginAttributes& aOriginAttributes);
 277   void FinishInit(BasePrincipal* aOther,
 278                   const OriginAttributes& aOriginAttributes);
 279
 280   // KeyValT holds a principal subtype-specific key value and the associated
 281   // parsed value after JSON parsing.
 282   template <typename SerializedKey>
 283   struct KeyValT {
 284     static_assert(sizeof(SerializedKey) == 1,
 285                   "SerializedKey should be a uint8_t");
 286     SerializedKey key;
 287     bool valueWasSerialized;
 288     nsCString value;
 289   };
 290
 291  private:
 292   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 293       nsIURI* aURI, const OriginAttributes& aAttrs,
 294       const nsACString& aOriginNoSuffix);
 295
 296   inline bool FastSubsumesIgnoringFPD(
 297       nsIPrincipal* aOther, DocumentDomainConsideration aConsideration);
 298
 299   RefPtr<nsAtom> mOriginNoSuffix;
 300   RefPtr<nsAtom> mOriginSuffix;
 301
 302   OriginAttributes mOriginAttributes;
 303   PrincipalKind mKind;
 304   bool mHasExplicitDomain;
 305   bool mInitialized;
 306 };
 307
 308 inline bool BasePrincipal::FastEquals(nsIPrincipal* aOther) {
 309   MOZ_ASSERT(aOther);
 310
 311   auto other = Cast(aOther);
 312   if (Kind() != other->Kind()) {
 313     // Principals of different kinds can't be equal.
 314     return false;
 315   }
 316
 317   // Two principals are considered to be equal if their origins are the same.
 318   // If the two principals are content principals, their origin attributes
 319   // (aka the origin suffix) must also match.
 320   if (Kind() == eSystemPrincipal) {
 321     return this == other;
 322   }
 323
 324   if (Kind() == eContentPrincipal || Kind() == eNullPrincipal) {
 325     return mOriginNoSuffix == other->mOriginNoSuffix &&
 326            mOriginSuffix == other->mOriginSuffix;
 327   }
 328
 329   MOZ_ASSERT(Kind() == eExpandedPrincipal);
 330   return mOriginNoSuffix == other->mOriginNoSuffix;
 331 }
 332
 333 inline bool BasePrincipal::FastEqualsConsideringDomain(nsIPrincipal* aOther) {
 334   MOZ_ASSERT(aOther);
 335
 336   // If neither of the principals have document.domain set, we use the fast path
 337   // in Equals().  Otherwise, we fall back to the slow path below.
 338   auto other = Cast(aOther);
 339   if (!mHasExplicitDomain && !other->mHasExplicitDomain) {
 340     return FastEquals(aOther);
 341   }
 342
 343   return Subsumes(aOther, ConsiderDocumentDomain) &&
 344          other->Subsumes(this, ConsiderDocumentDomain);
 345 }
 346
 347 inline bool BasePrincipal::FastSubsumes(nsIPrincipal* aOther) {
 348   MOZ_ASSERT(aOther);
 349
 350   // If two principals are equal, then they both subsume each other.
 351   if (FastEquals(aOther)) {
 352     return true;
 353   }
 354
 355   // Otherwise, fall back to the slow path.
 356   return Subsumes(aOther, DontConsiderDocumentDomain);
 357 }
 358
 359 inline bool BasePrincipal::FastSubsumesConsideringDomain(nsIPrincipal* aOther) {
 360   MOZ_ASSERT(aOther);
 361
 362   // If neither of the principals have document.domain set, we hand off to
 363   // FastSubsumes() which has fast paths for some special cases. Otherwise, we
 364   // fall back to the slow path below.
 365   if (!mHasExplicitDomain && !Cast(aOther)->mHasExplicitDomain) {
 366     return FastSubsumes(aOther);
 367   }
 368
 369   return Subsumes(aOther, ConsiderDocumentDomain);
 370 }
 371
 372 inline bool BasePrincipal::FastSubsumesIgnoringFPD(
 373     nsIPrincipal* aOther, DocumentDomainConsideration aConsideration) {
 374   MOZ_ASSERT(aOther);
 375
 376   if (Kind() == eContentPrincipal &&
 377       !dom::ChromeUtils::IsOriginAttributesEqualIgnoringFPD(
 378           mOriginAttributes, Cast(aOther)->mOriginAttributes)) {
 379     return false;
 380   }
 381
 382   return SubsumesInternal(aOther, aConsideration);
 383 }
 384
 385 inline bool BasePrincipal::FastSubsumesIgnoringFPD(nsIPrincipal* aOther) {
 386   return FastSubsumesIgnoringFPD(aOther, DontConsiderDocumentDomain);
 387 }
 388
 389 inline bool BasePrincipal::FastSubsumesConsideringDomainIgnoringFPD(
 390     nsIPrincipal* aOther) {
 391   return FastSubsumesIgnoringFPD(aOther, ConsiderDocumentDomain);
 392 }
 393
 394 inline bool BasePrincipal::IsSystemPrincipal() const {
 395   return Kind() == eSystemPrincipal;
 396 }
 397
 398 }  // namespace mozilla
 399
 400 inline bool nsIPrincipal::IsSystemPrincipal() const {
 401   return mozilla::BasePrincipal::Cast(this)->IsSystemPrincipal();
 402 }
 403
 404 #endif /* mozilla_BasePrincipal_h */