caps/BasePrincipal.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef mozilla_BasePrincipal_h
   8 #define mozilla_BasePrincipal_h
   9
  10 #include "nsJSPrincipals.h"
  11
  12 #include "mozilla/Attributes.h"
  13 #include "mozilla/OriginAttributes.h"
  14
  15 class nsAtom;
  16 class nsIContentSecurityPolicy;
  17 class nsIObjectOutputStream;
  18 class nsIObjectInputStream;
  19 class nsIURI;
  20
  21 class ExpandedPrincipal;
  22
  23 namespace Json {
  24 class Value;
  25 }
  26 namespace mozilla {
  27 namespace dom {
  28 class Document;
  29 }
  30 namespace extensions {
  31 class WebExtensionPolicy;
  32 }
  33
  34 class BasePrincipal;
  35
  36 // Content principals (and content principals embedded within expanded
  37 // principals) stored in SiteIdentifier are guaranteed to contain only the
  38 // eTLD+1 part of the original domain. This is used to determine whether two
  39 // origins are same-site: if it's possible for two origins to access each other
  40 // (maybe after mutating document.domain), then they must have the same site
  41 // identifier.
  42 class SiteIdentifier {
  43  public:
  44   void Init(BasePrincipal* aPrincipal) {
  45     MOZ_ASSERT(aPrincipal);
  46     mPrincipal = aPrincipal;
  47   }
  48
  49   bool IsInitialized() const { return !!mPrincipal; }
  50
  51   bool Equals(const SiteIdentifier& aOther) const;
  52
  53  private:
  54   friend class ::ExpandedPrincipal;
  55
  56   BasePrincipal* GetPrincipal() const {
  57     MOZ_ASSERT(IsInitialized());
  58     return mPrincipal;
  59   }
  60
  61   RefPtr<BasePrincipal> mPrincipal;
  62 };
  63
  64 /*
  65  * Base class from which all nsIPrincipal implementations inherit. Use this for
  66  * default implementations and other commonalities between principal
  67  * implementations.
  68  *
  69  * We should merge nsJSPrincipals into this class at some point.
  70  */
  71 class BasePrincipal : public nsJSPrincipals {
  72  public:
  73   // Warning: this enum impacts Principal serialization into JSON format.
  74   // Only update if you know exactly what you are doing
  75   enum PrincipalKind {
  76     eNullPrincipal = 0,
  77     eContentPrincipal,
  78     eExpandedPrincipal,
  79     eSystemPrincipal,
  80     eKindMax = eSystemPrincipal
  81   };
  82
  83   explicit BasePrincipal(PrincipalKind aKind);
  84
  85   template <typename T>
  86   bool Is() const {
  87     return mKind == T::Kind();
  88   }
  89
  90   template <typename T>
  91   T* As() {
  92     MOZ_ASSERT(Is<T>());
  93     return static_cast<T*>(this);
  94   }
  95
  96   enum DocumentDomainConsideration {
  97     DontConsiderDocumentDomain,
  98     ConsiderDocumentDomain
  99   };
 100   bool Subsumes(nsIPrincipal* aOther,
 101                 DocumentDomainConsideration aConsideration);
 102
 103   NS_IMETHOD GetOrigin(nsACString& aOrigin) final;
 104   NS_IMETHOD GetAsciiOrigin(nsACString& aOrigin) override;
 105   NS_IMETHOD GetOriginNoSuffix(nsACString& aOrigin) final;
 106   NS_IMETHOD Equals(nsIPrincipal* other, bool* _retval) final;
 107   NS_IMETHOD EqualsConsideringDomain(nsIPrincipal* other, bool* _retval) final;
 108   NS_IMETHOD EqualsURI(nsIURI* aOtherURI, bool* _retval) override;
 109   NS_IMETHOD EqualsForPermission(nsIPrincipal* other, bool aExactHost,
 110                                  bool* _retval) final;
 111   NS_IMETHOD Subsumes(nsIPrincipal* other, bool* _retval) final;
 112   NS_IMETHOD SubsumesConsideringDomain(nsIPrincipal* other,
 113                                        bool* _retval) final;
 114   NS_IMETHOD SubsumesConsideringDomainIgnoringFPD(nsIPrincipal* other,
 115                                                   bool* _retval) final;
 116   NS_IMETHOD CheckMayLoad(nsIURI* uri, bool allowIfInheritsPrincipal) final;
 117   NS_IMETHOD CheckMayLoadWithReporting(nsIURI* uri,
 118                                        bool allowIfInheritsPrincipal,
 119                                        uint64_t innerWindowID) final;
 120   NS_IMETHOD GetAddonPolicy(nsISupports** aResult) final;
 121   NS_IMETHOD GetIsNullPrincipal(bool* aResult) override;
 122   NS_IMETHOD GetIsContentPrincipal(bool* aResult) override;
 123   NS_IMETHOD GetIsExpandedPrincipal(bool* aResult) override;
 124   NS_IMETHOD GetIsSystemPrincipal(bool* aResult) override;
 125   NS_IMETHOD GetScheme(nsACString& aScheme) override;
 126   NS_IMETHOD SchemeIs(const char* aScheme, bool* aResult) override;
 127   NS_IMETHOD IsURIInPrefList(const char* aPref, bool* aResult) override;
 128   NS_IMETHOD IsL10nAllowed(nsIURI* aURI, bool* aResult) override;
 129   NS_IMETHOD GetAboutModuleFlags(uint32_t* flags) override;
 130   NS_IMETHOD GetIsAddonOrExpandedAddonPrincipal(bool* aResult) override;
 131   NS_IMETHOD GetOriginAttributes(JSContext* aCx,
 132                                  JS::MutableHandle<JS::Value> aVal) final;
 133   NS_IMETHOD GetAsciiSpec(nsACString& aSpec) override;
 134   NS_IMETHOD GetExposablePrePath(nsACString& aResult) override;
 135   NS_IMETHOD GetExposableSpec(nsACString& aSpec) override;
 136   NS_IMETHOD GetHostPort(nsACString& aRes) override;
 137   NS_IMETHOD GetHost(nsACString& aRes) override;
 138   NS_IMETHOD GetPrepath(nsACString& aResult) override;
 139   NS_IMETHOD GetFilePath(nsACString& aResult) override;
 140   NS_IMETHOD GetOriginSuffix(nsACString& aOriginSuffix) final;
 141   NS_IMETHOD GetIsIpAddress(bool* aIsIpAddress) override;
 142   NS_IMETHOD GetIsOnion(bool* aIsOnion) override;
 143   NS_IMETHOD GetIsInIsolatedMozBrowserElement(
 144       bool* aIsInIsolatedMozBrowserElement) final;
 145   NS_IMETHOD GetUserContextId(uint32_t* aUserContextId) final;
 146   NS_IMETHOD GetPrivateBrowsingId(uint32_t* aPrivateBrowsingId) final;
 147   NS_IMETHOD GetSiteOrigin(nsACString& aOrigin) override;
 148   NS_IMETHOD IsThirdPartyURI(nsIURI* uri, bool* aRes) override;
 149   NS_IMETHOD IsThirdPartyPrincipal(nsIPrincipal* uri, bool* aRes) override;
 150   NS_IMETHOD IsThirdPartyChannel(nsIChannel* aChannel, bool* aRes) override;
 151   NS_IMETHOD GetIsOriginPotentiallyTrustworthy(bool* aResult) override;
 152   NS_IMETHOD IsSameOrigin(nsIURI* aURI, bool aIsPrivateWin,
 153                           bool* aRes) override;
 154   NS_IMETHOD GetPrefLightCacheKey(nsIURI* aURI, bool aWithCredentials,
 155                                   nsACString& _retval) override;
 156   NS_IMETHOD HasFirstpartyStorageAccess(mozIDOMWindow* aCheckWindow,
 157                                         uint32_t* aRejectedReason,
 158                                         bool* aOutAllowed) override;
 159   NS_IMETHOD GetAsciiHost(nsACString& aAsciiHost) override;
 160   NS_IMETHOD GetLocalStorageQuotaKey(nsACString& aRes) override;
 161   NS_IMETHOD AllowsRelaxStrictFileOriginPolicy(nsIURI* aURI,
 162                                                bool* aRes) override;
 163   NS_IMETHOD CreateReferrerInfo(mozilla::dom::ReferrerPolicy aReferrerPolicy,
 164                                 nsIReferrerInfo** _retval) override;
 165   NS_IMETHOD GetIsScriptAllowedByPolicy(
 166       bool* aIsScriptAllowedByPolicy) override;
 167   NS_IMETHOD GetStorageOriginKey(nsACString& aOriginKey) override;
 168
 169   NS_IMETHOD GetNextSubDomainPrincipal(
 170       nsIPrincipal** aNextSubDomainPrincipal) override;
 171   nsresult ToJSON(nsACString& aJSON);
 172   static already_AddRefed<BasePrincipal> FromJSON(const nsACString& aJSON);
 173   // Method populates a passed Json::Value with serializable fields
 174   // which represent all of the fields to deserialize the principal
 175   virtual nsresult PopulateJSONObject(Json::Value& aObject);
 176
 177   virtual bool AddonHasPermission(const nsAtom* aPerm);
 178
 179   virtual bool IsContentPrincipal() const { return false; };
 180
 181   static BasePrincipal* Cast(nsIPrincipal* aPrin) {
 182     return static_cast<BasePrincipal*>(aPrin);
 183   }
 184
 185   static BasePrincipal& Cast(nsIPrincipal& aPrin) {
 186     return *static_cast<BasePrincipal*>(&aPrin);
 187   }
 188
 189   static const BasePrincipal* Cast(const nsIPrincipal* aPrin) {
 190     return static_cast<const BasePrincipal*>(aPrin);
 191   }
 192
 193   static const BasePrincipal& Cast(const nsIPrincipal& aPrin) {
 194     return *static_cast<const BasePrincipal*>(&aPrin);
 195   }
 196
 197   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 198       const nsACString& aOrigin);
 199
 200   // These following method may not create a content principal in case it's
 201   // not possible to generate a correct origin from the passed URI. If this
 202   // happens, a NullPrincipal is returned.
 203
 204   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 205       nsIURI* aURI, const OriginAttributes& aAttrs);
 206
 207   const OriginAttributes& OriginAttributesRef() final {
 208     return mOriginAttributes;
 209   }
 210   extensions::WebExtensionPolicy* AddonPolicy();
 211   uint32_t UserContextId() const { return mOriginAttributes.mUserContextId; }
 212   uint32_t PrivateBrowsingId() const {
 213     return mOriginAttributes.mPrivateBrowsingId;
 214   }
 215   bool IsInIsolatedMozBrowserElement() const {
 216     return mOriginAttributes.mInIsolatedMozBrowser;
 217   }
 218
 219   PrincipalKind Kind() const { return mKind; }
 220
 221   already_AddRefed<BasePrincipal> CloneForcingOriginAttributes(
 222       const OriginAttributes& aOriginAttributes);
 223
 224   // If this is an add-on content script principal, returns its AddonPolicy.
 225   // Otherwise returns null.
 226   extensions::WebExtensionPolicy* ContentScriptAddonPolicy();
 227
 228   // Helper to check whether this principal is associated with an addon that
 229   // allows unprivileged code to load aURI.  aExplicit == true will prevent
 230   // use of all_urls permission, requiring the domain in its permissions.
 231   bool AddonAllowsLoad(nsIURI* aURI, bool aExplicit = false);
 232
 233   // Call these to avoid the cost of virtual dispatch.
 234   inline bool FastEquals(nsIPrincipal* aOther);
 235   inline bool FastEqualsConsideringDomain(nsIPrincipal* aOther);
 236   inline bool FastSubsumes(nsIPrincipal* aOther);
 237   inline bool FastSubsumesConsideringDomain(nsIPrincipal* aOther);
 238   inline bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther);
 239   inline bool FastSubsumesConsideringDomainIgnoringFPD(nsIPrincipal* aOther);
 240
 241   // Fast way to check whether we have a system principal.
 242   inline bool IsSystemPrincipal() const;
 243
 244   // Returns the principal to inherit when a caller with this principal loads
 245   // the given URI.
 246   //
 247   // For most principal types, this returns the principal itself. For expanded
 248   // principals, it returns the first sub-principal which subsumes the given URI
 249   // (or, if no URI is given, the last allowlist principal).
 250   nsIPrincipal* PrincipalToInherit(nsIURI* aRequestedURI = nullptr);
 251
 252   /* Returns true if this principal's CSP should override a document's CSP for
 253    * loads that it triggers. Currently true for expanded principals which
 254    * subsume the document principal, and add-on content principals regardless
 255    * of whether they subsume the document principal.
 256    */
 257   bool OverridesCSP(nsIPrincipal* aDocumentPrincipal) {
 258     MOZ_ASSERT(aDocumentPrincipal);
 259
 260     // Expanded principals override CSP if and only if they subsume the document
 261     // principal.
 262     if (mKind == eExpandedPrincipal) {
 263       return FastSubsumes(aDocumentPrincipal);
 264     }
 265     // Extension principals always override the CSP non-extension principals.
 266     // This is primarily for the sake of their stylesheets, which are usually
 267     // loaded from channels and cannot have expanded principals.
 268     return (AddonPolicy() &&
 269             !BasePrincipal::Cast(aDocumentPrincipal)->AddonPolicy());
 270   }
 271
 272   uint32_t GetOriginNoSuffixHash() const { return mOriginNoSuffix->hash(); }
 273   uint32_t GetOriginSuffixHash() const { return mOriginSuffix->hash(); }
 274
 275   virtual nsresult GetSiteIdentifier(SiteIdentifier& aSite) = 0;
 276
 277  protected:
 278   virtual ~BasePrincipal();
 279
 280   // Note that this does not check OriginAttributes. Callers that depend on
 281   // those must call Subsumes instead.
 282   virtual bool SubsumesInternal(nsIPrincipal* aOther,
 283                                 DocumentDomainConsideration aConsider) = 0;
 284
 285   // Internal, side-effect-free check to determine whether the concrete
 286   // principal would allow the load ignoring any common behavior implemented in
 287   // BasePrincipal::CheckMayLoad.
 288   virtual bool MayLoadInternal(nsIURI* aURI) = 0;
 289   friend class ::ExpandedPrincipal;
 290
 291   // Helper for implementing CheckMayLoad and CheckMayLoadWithReporting.
 292   nsresult CheckMayLoadHelper(nsIURI* aURI, bool aAllowIfInheritsPrincipal,
 293                               bool aReport, uint64_t aInnerWindowID);
 294
 295   void SetHasExplicitDomain() { mHasExplicitDomain = true; }
 296
 297   // Either of these functions should be called as the last step of the
 298   // initialization of the principal objects.  It's typically called as the
 299   // last step from the Init() method of the child classes.
 300   void FinishInit(const nsACString& aOriginNoSuffix,
 301                   const OriginAttributes& aOriginAttributes);
 302   void FinishInit(BasePrincipal* aOther,
 303                   const OriginAttributes& aOriginAttributes);
 304
 305   // KeyValT holds a principal subtype-specific key value and the associated
 306   // parsed value after JSON parsing.
 307   template <typename SerializedKey>
 308   struct KeyValT {
 309     static_assert(sizeof(SerializedKey) == 1,
 310                   "SerializedKey should be a uint8_t");
 311     SerializedKey key;
 312     bool valueWasSerialized;
 313     nsCString value;
 314   };
 315
 316  private:
 317   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 318       nsIURI* aURI, const OriginAttributes& aAttrs,
 319       const nsACString& aOriginNoSuffix);
 320
 321   inline bool FastSubsumesIgnoringFPD(
 322       nsIPrincipal* aOther, DocumentDomainConsideration aConsideration);
 323
 324   RefPtr<nsAtom> mOriginNoSuffix;
 325   RefPtr<nsAtom> mOriginSuffix;
 326
 327   OriginAttributes mOriginAttributes;
 328   PrincipalKind mKind;
 329   bool mHasExplicitDomain;
 330   bool mInitialized;
 331 };
 332
 333 inline bool BasePrincipal::FastEquals(nsIPrincipal* aOther) {
 334   MOZ_ASSERT(aOther);
 335
 336   auto other = Cast(aOther);
 337   if (Kind() != other->Kind()) {
 338     // Principals of different kinds can't be equal.
 339     return false;
 340   }
 341
 342   // Two principals are considered to be equal if their origins are the same.
 343   // If the two principals are content principals, their origin attributes
 344   // (aka the origin suffix) must also match.
 345   if (Kind() == eSystemPrincipal) {
 346     return this == other;
 347   }
 348
 349   if (Kind() == eContentPrincipal || Kind() == eNullPrincipal) {
 350     return mOriginNoSuffix == other->mOriginNoSuffix &&
 351            mOriginSuffix == other->mOriginSuffix;
 352   }
 353
 354   MOZ_ASSERT(Kind() == eExpandedPrincipal);
 355   return mOriginNoSuffix == other->mOriginNoSuffix;
 356 }
 357
 358 inline bool BasePrincipal::FastEqualsConsideringDomain(nsIPrincipal* aOther) {
 359   MOZ_ASSERT(aOther);
 360
 361   // If neither of the principals have document.domain set, we use the fast path
 362   // in Equals().  Otherwise, we fall back to the slow path below.
 363   auto other = Cast(aOther);
 364   if (!mHasExplicitDomain && !other->mHasExplicitDomain) {
 365     return FastEquals(aOther);
 366   }
 367
 368   return Subsumes(aOther, ConsiderDocumentDomain) &&
 369          other->Subsumes(this, ConsiderDocumentDomain);
 370 }
 371
 372 inline bool BasePrincipal::FastSubsumes(nsIPrincipal* aOther) {
 373   MOZ_ASSERT(aOther);
 374
 375   // If two principals are equal, then they both subsume each other.
 376   if (FastEquals(aOther)) {
 377     return true;
 378   }
 379
 380   // Otherwise, fall back to the slow path.
 381   return Subsumes(aOther, DontConsiderDocumentDomain);
 382 }
 383
 384 inline bool BasePrincipal::FastSubsumesConsideringDomain(nsIPrincipal* aOther) {
 385   MOZ_ASSERT(aOther);
 386
 387   // If neither of the principals have document.domain set, we hand off to
 388   // FastSubsumes() which has fast paths for some special cases. Otherwise, we
 389   // fall back to the slow path below.
 390   if (!mHasExplicitDomain && !Cast(aOther)->mHasExplicitDomain) {
 391     return FastSubsumes(aOther);
 392   }
 393
 394   return Subsumes(aOther, ConsiderDocumentDomain);
 395 }
 396
 397 inline bool BasePrincipal::FastSubsumesIgnoringFPD(
 398     nsIPrincipal* aOther, DocumentDomainConsideration aConsideration) {
 399   MOZ_ASSERT(aOther);
 400
 401   if (Kind() == eContentPrincipal &&
 402       !dom::ChromeUtils::IsOriginAttributesEqualIgnoringFPD(
 403           mOriginAttributes, Cast(aOther)->mOriginAttributes)) {
 404     return false;
 405   }
 406
 407   return SubsumesInternal(aOther, aConsideration);
 408 }
 409
 410 inline bool BasePrincipal::FastSubsumesIgnoringFPD(nsIPrincipal* aOther) {
 411   return FastSubsumesIgnoringFPD(aOther, DontConsiderDocumentDomain);
 412 }
 413
 414 inline bool BasePrincipal::FastSubsumesConsideringDomainIgnoringFPD(
 415     nsIPrincipal* aOther) {
 416   return FastSubsumesIgnoringFPD(aOther, ConsiderDocumentDomain);
 417 }
 418
 419 inline bool BasePrincipal::IsSystemPrincipal() const {
 420   return Kind() == eSystemPrincipal;
 421 }
 422
 423 }  // namespace mozilla
 424
 425 inline bool nsIPrincipal::IsSystemPrincipal() const {
 426   return mozilla::BasePrincipal::Cast(this)->IsSystemPrincipal();
 427 }
 428
 429 #endif /* mozilla_BasePrincipal_h */