caps/NullPrincipal.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set sw=2 sts=2 ts=2 et tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 /**
   8  * This is the principal that has no rights and can't be accessed by
   9  * anything other than itself and chrome; null principals are not
  10  * same-origin with anything but themselves.
  11  */
  12
  13 #include "mozilla/ArrayUtils.h"
  14
  15 #include "mozilla/dom/BlobURLProtocolHandler.h"
  16 #include "mozilla/StaticPrefs_network.h"
  17 #include "nsDocShell.h"
  18 #include "NullPrincipal.h"
  19 #include "DefaultURI.h"
  20 #include "nsSimpleURI.h"
  21 #include "nsMemory.h"
  22 #include "nsIClassInfoImpl.h"
  23 #include "nsNetCID.h"
  24 #include "nsError.h"
  25 #include "nsEscape.h"
  26 #include "ContentPrincipal.h"
  27 #include "nsScriptSecurityManager.h"
  28 #include "pratom.h"
  29 #include "nsIObjectInputStream.h"
  30
  31 #include "json/json.h"
  32
  33 using namespace mozilla;
  34
  35 NS_IMPL_CLASSINFO(NullPrincipal, nullptr, nsIClassInfo::MAIN_THREAD_ONLY,
  36                   NS_NULLPRINCIPAL_CID)
  37 NS_IMPL_QUERY_INTERFACE_CI(NullPrincipal, nsIPrincipal)
  38 NS_IMPL_CI_INTERFACE_GETTER(NullPrincipal, nsIPrincipal)
  39
  40 NullPrincipal::NullPrincipal(nsIURI* aURI, const nsACString& aOriginNoSuffix,
  41                              const OriginAttributes& aOriginAttributes)
  42     : BasePrincipal(eNullPrincipal, aOriginNoSuffix, aOriginAttributes),
  43       mURI(aURI) {}
  44
  45 /* static */
  46 already_AddRefed<NullPrincipal> NullPrincipal::CreateWithInheritedAttributes(
  47     nsIPrincipal* aInheritFrom) {
  48   MOZ_ASSERT(aInheritFrom);
  49   return CreateInternal(Cast(aInheritFrom)->OriginAttributesRef(), false,
  50                         nullptr, aInheritFrom);
  51 }
  52
  53 /* static */
  54 already_AddRefed<NullPrincipal> NullPrincipal::CreateWithInheritedAttributes(
  55     nsIDocShell* aDocShell, bool aIsFirstParty) {
  56   MOZ_ASSERT(aDocShell);
  57
  58   OriginAttributes attrs = nsDocShell::Cast(aDocShell)->GetOriginAttributes();
  59   return CreateWithInheritedAttributes(attrs, aIsFirstParty);
  60 }
  61
  62 /* static */
  63 already_AddRefed<NullPrincipal> NullPrincipal::CreateWithInheritedAttributes(
  64     const OriginAttributes& aOriginAttributes, bool aIsFirstParty) {
  65   return CreateInternal(aOriginAttributes, aIsFirstParty);
  66 }
  67
  68 /* static */
  69 already_AddRefed<NullPrincipal> NullPrincipal::Create(
  70     const OriginAttributes& aOriginAttributes, nsIURI* aURI) {
  71   return CreateInternal(aOriginAttributes, false, aURI);
  72 }
  73
  74 /* static */
  75 already_AddRefed<NullPrincipal> NullPrincipal::CreateWithoutOriginAttributes() {
  76   return NullPrincipal::Create(OriginAttributes(), nullptr);
  77 }
  78
  79 static void EscapePrecursorQuery(nsACString& aPrecursorQuery) {
  80   // origins should not contain existing escape sequences, so set `esc_Forced`
  81   // to force any `%` in the input to be escaped in addition to non-ascii,
  82   // control characters and DEL.
  83   nsCString modified;
  84   if (NS_EscapeURLSpan(aPrecursorQuery, esc_OnlyNonASCII | esc_Forced,
  85                        modified)) {
  86     aPrecursorQuery.Assign(std::move(modified));
  87   }
  88 }
  89
  90 static void UnescapePrecursorQuery(nsACString& aPrecursorQuery) {
  91   nsCString modified;
  92   if (NS_UnescapeURL(aPrecursorQuery.BeginReading(), aPrecursorQuery.Length(),
  93                      /* aFlags */ 0, modified)) {
  94     aPrecursorQuery.Assign(std::move(modified));
  95   }
  96 }
  97
  98 already_AddRefed<nsIURI> NullPrincipal::CreateURI(
  99     nsIPrincipal* aPrecursor, const nsID* aNullPrincipalID) {
 100   nsCOMPtr<nsIURIMutator> iMutator;
 101   if (StaticPrefs::network_url_useDefaultURI()) {
 102     iMutator = new mozilla::net::DefaultURI::Mutator();
 103   } else {
 104     iMutator = new mozilla::net::nsSimpleURI::Mutator();
 105   }
 106
 107   nsID uuid = aNullPrincipalID ? *aNullPrincipalID : nsID::GenerateUUID();
 108
 109   NS_MutateURI mutator(iMutator);
 110   mutator.SetSpec(NS_NULLPRINCIPAL_SCHEME ":"_ns +
 111                   nsDependentCString(nsIDToCString(uuid).get()));
 112
 113   // If there's a precursor URI, encode it in the null principal URI's query.
 114   if (aPrecursor) {
 115     nsAutoCString precursorOrigin;
 116     switch (BasePrincipal::Cast(aPrecursor)->Kind()) {
 117       case eNullPrincipal: {
 118         // If the precursor null principal has a precursor, inherit it.
 119         if (nsCOMPtr<nsIURI> nullPrecursorURI = aPrecursor->GetURI()) {
 120           MOZ_ALWAYS_SUCCEEDS(nullPrecursorURI->GetQuery(precursorOrigin));
 121         }
 122         break;
 123       }
 124       case eContentPrincipal: {
 125         MOZ_ALWAYS_SUCCEEDS(aPrecursor->GetOriginNoSuffix(precursorOrigin));
 126 #ifdef DEBUG
 127         nsAutoCString original(precursorOrigin);
 128 #endif
 129         EscapePrecursorQuery(precursorOrigin);
 130 #ifdef DEBUG
 131         nsAutoCString unescaped(precursorOrigin);
 132         UnescapePrecursorQuery(unescaped);
 133         MOZ_ASSERT(unescaped == original,
 134                    "cannot recover original precursor origin after escape");
 135 #endif
 136         break;
 137       }
 138
 139       // For now, we won't track expanded or system principal precursors. We may
 140       // want to track expanded principal precursors in the future, but it's
 141       // unlikely we'll want to track system principal precursors.
 142       case eExpandedPrincipal:
 143       case eSystemPrincipal:
 144         break;
 145     }
 146     if (!precursorOrigin.IsEmpty()) {
 147       mutator.SetQuery(precursorOrigin);
 148     }
 149   }
 150
 151   nsCOMPtr<nsIURI> uri;
 152   MOZ_ALWAYS_SUCCEEDS(mutator.Finalize(getter_AddRefs(uri)));
 153   return uri.forget();
 154 }
 155
 156 already_AddRefed<NullPrincipal> NullPrincipal::CreateInternal(
 157     const OriginAttributes& aOriginAttributes, bool aIsFirstParty, nsIURI* aURI,
 158     nsIPrincipal* aPrecursor) {
 159   MOZ_ASSERT_IF(aPrecursor, !aURI);
 160   nsCOMPtr<nsIURI> uri = aURI;
 161   if (!uri) {
 162     uri = NullPrincipal::CreateURI(aPrecursor);
 163   }
 164
 165   MOZ_RELEASE_ASSERT(uri->SchemeIs(NS_NULLPRINCIPAL_SCHEME));
 166
 167   nsAutoCString originNoSuffix;
 168   DebugOnly<nsresult> rv = uri->GetSpec(originNoSuffix);
 169   MOZ_ASSERT(NS_SUCCEEDED(rv));
 170
 171   OriginAttributes attrs(aOriginAttributes);
 172   if (aIsFirstParty) {
 173     // The FirstPartyDomain attribute will not include information about the
 174     // precursor origin.
 175     nsAutoCString path;
 176     rv = uri->GetFilePath(path);
 177     MOZ_ASSERT(NS_SUCCEEDED(rv));
 178
 179     // remove the '{}' characters from both ends.
 180     path.Mid(path, 1, path.Length() - 2);
 181     path.AppendLiteral(".mozilla");
 182     attrs.SetFirstPartyDomain(true, path);
 183   }
 184
 185   RefPtr<NullPrincipal> nullPrin =
 186       new NullPrincipal(uri, originNoSuffix, attrs);
 187   return nullPrin.forget();
 188 }
 189
 190 nsresult NullPrincipal::GetScriptLocation(nsACString& aStr) {
 191   return mURI->GetSpec(aStr);
 192 }
 193
 194 /**
 195  * nsIPrincipal implementation
 196  */
 197
 198 uint32_t NullPrincipal::GetHashValue() { return (NS_PTR_TO_INT32(this) >> 2); }
 199
 200 NS_IMETHODIMP
 201 NullPrincipal::GetURI(nsIURI** aURI) {
 202   nsCOMPtr<nsIURI> uri = mURI;
 203   uri.forget(aURI);
 204   return NS_OK;
 205 }
 206 NS_IMETHODIMP
 207 NullPrincipal::GetIsOriginPotentiallyTrustworthy(bool* aResult) {
 208   *aResult = false;
 209   return NS_OK;
 210 }
 211
 212 NS_IMETHODIMP
 213 NullPrincipal::GetDomain(nsIURI** aDomain) {
 214   nsCOMPtr<nsIURI> uri = mURI;
 215   uri.forget(aDomain);
 216   return NS_OK;
 217 }
 218
 219 NS_IMETHODIMP
 220 NullPrincipal::SetDomain(nsIURI* aDomain) {
 221   // I think the right thing to do here is to just throw...  Silently failing
 222   // seems counterproductive.
 223   return NS_ERROR_NOT_AVAILABLE;
 224 }
 225
 226 bool NullPrincipal::MayLoadInternal(nsIURI* aURI) {
 227   // Also allow the load if we are the principal of the URI being checked.
 228   nsCOMPtr<nsIPrincipal> blobPrincipal;
 229   if (dom::BlobURLProtocolHandler::GetBlobURLPrincipal(
 230           aURI, getter_AddRefs(blobPrincipal))) {
 231     MOZ_ASSERT(blobPrincipal);
 232     return SubsumesInternal(blobPrincipal,
 233                             BasePrincipal::ConsiderDocumentDomain);
 234   }
 235
 236   return false;
 237 }
 238
 239 NS_IMETHODIMP
 240 NullPrincipal::GetBaseDomain(nsACString& aBaseDomain) {
 241   // For a null principal, we use our unique uuid as the base domain.
 242   return mURI->GetPathQueryRef(aBaseDomain);
 243 }
 244
 245 NS_IMETHODIMP
 246 NullPrincipal::GetAddonId(nsAString& aAddonId) {
 247   aAddonId.Truncate();
 248   return NS_OK;
 249 };
 250
 251 /**
 252  * nsISerializable implementation
 253  */
 254 NS_IMETHODIMP
 255 NullPrincipal::Deserializer::Read(nsIObjectInputStream* aStream) {
 256   nsAutoCString spec;
 257   nsresult rv = aStream->ReadCString(spec);
 258   NS_ENSURE_SUCCESS(rv, rv);
 259
 260   nsCOMPtr<nsIURI> uri;
 261   rv = NS_NewURI(getter_AddRefs(uri), spec);
 262   NS_ENSURE_SUCCESS(rv, rv);
 263
 264   nsAutoCString suffix;
 265   rv = aStream->ReadCString(suffix);
 266   NS_ENSURE_SUCCESS(rv, rv);
 267
 268   OriginAttributes attrs;
 269   bool ok = attrs.PopulateFromSuffix(suffix);
 270   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 271
 272   mPrincipal = NullPrincipal::Create(attrs, uri);
 273   NS_ENSURE_TRUE(mPrincipal, NS_ERROR_FAILURE);
 274
 275   return NS_OK;
 276 }
 277
 278 nsresult NullPrincipal::PopulateJSONObject(Json::Value& aObject) {
 279   nsAutoCString principalURI;
 280   nsresult rv = mURI->GetSpec(principalURI);
 281   NS_ENSURE_SUCCESS(rv, rv);
 282   aObject[std::to_string(eSpec)] = principalURI.get();
 283
 284   nsAutoCString suffix;
 285   OriginAttributesRef().CreateSuffix(suffix);
 286   if (suffix.Length() > 0) {
 287     aObject[std::to_string(eSuffix)] = suffix.get();
 288   }
 289
 290   return NS_OK;
 291 }
 292
 293 already_AddRefed<BasePrincipal> NullPrincipal::FromProperties(
 294     nsTArray<NullPrincipal::KeyVal>& aFields) {
 295   MOZ_ASSERT(aFields.Length() == eMax + 1, "Must have all the keys");
 296   nsresult rv;
 297   nsCOMPtr<nsIURI> uri;
 298   OriginAttributes attrs;
 299
 300   // The odd structure here is to make the code to not compile
 301   // if all the switch enum cases haven't been codified
 302   for (const auto& field : aFields) {
 303     switch (field.key) {
 304       case NullPrincipal::eSpec:
 305         if (!field.valueWasSerialized) {
 306           MOZ_ASSERT(false,
 307                      "Null principals require a spec URI in serialized JSON");
 308           return nullptr;
 309         }
 310         rv = NS_NewURI(getter_AddRefs(uri), field.value);
 311         NS_ENSURE_SUCCESS(rv, nullptr);
 312         break;
 313       case NullPrincipal::eSuffix:
 314         bool ok = attrs.PopulateFromSuffix(field.value);
 315         if (!ok) {
 316           return nullptr;
 317         }
 318         break;
 319     }
 320   }
 321
 322   if (!uri) {
 323     MOZ_ASSERT(false, "No URI deserialized");
 324     return nullptr;
 325   }
 326
 327   return NullPrincipal::Create(attrs, uri);
 328 }
 329
 330 NS_IMETHODIMP
 331 NullPrincipal::GetPrecursorPrincipal(nsIPrincipal** aPrincipal) {
 332   *aPrincipal = nullptr;
 333
 334   nsAutoCString query;
 335   if (NS_FAILED(mURI->GetQuery(query)) || query.IsEmpty()) {
 336     return NS_OK;
 337   }
 338   UnescapePrecursorQuery(query);
 339
 340   nsCOMPtr<nsIURI> precursorURI;
 341   if (NS_FAILED(NS_NewURI(getter_AddRefs(precursorURI), query))) {
 342     MOZ_ASSERT_UNREACHABLE(
 343         "Failed to parse precursor from nullprincipal query");
 344     return NS_OK;
 345   }
 346
 347   // If our precursor is another null principal, re-construct it. This can
 348   // happen if a null principal without a precursor causes another principal to
 349   // be created.
 350   if (precursorURI->SchemeIs(NS_NULLPRINCIPAL_SCHEME)) {
 351 #ifdef DEBUG
 352     nsAutoCString precursorQuery;
 353     precursorURI->GetQuery(precursorQuery);
 354     MOZ_ASSERT(precursorQuery.IsEmpty(),
 355                "Null principal with nested precursors?");
 356 #endif
 357     *aPrincipal =
 358         NullPrincipal::Create(OriginAttributesRef(), precursorURI).take();
 359     return NS_OK;
 360   }
 361
 362   RefPtr<BasePrincipal> contentPrincipal =
 363       BasePrincipal::CreateContentPrincipal(precursorURI,
 364                                             OriginAttributesRef());
 365   // If `CreateContentPrincipal` failed, it will create a new NullPrincipal and
 366   // return that instead. We only want to return real content principals here.
 367   if (!contentPrincipal || !contentPrincipal->Is<ContentPrincipal>()) {
 368     return NS_OK;
 369   }
 370   contentPrincipal.forget(aPrincipal);
 371   return NS_OK;
 372 }