caps/ContentPrincipal.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=2 sw=2 et tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ContentPrincipal.h"
   8
   9 #include "mozIThirdPartyUtil.h"
  10 #include "nsContentUtils.h"
  11 #include "nscore.h"
  12 #include "nsScriptSecurityManager.h"
  13 #include "nsString.h"
  14 #include "nsReadableUtils.h"
  15 #include "pratom.h"
  16 #include "nsIURI.h"
  17 #include "nsIURL.h"
  18 #include "nsIStandardURL.h"
  19 #include "nsIURIWithSpecialOrigin.h"
  20 #include "nsIURIMutator.h"
  21 #include "nsJSPrincipals.h"
  22 #include "nsIEffectiveTLDService.h"
  23 #include "nsIClassInfoImpl.h"
  24 #include "nsIObjectInputStream.h"
  25 #include "nsIObjectOutputStream.h"
  26 #include "nsIProtocolHandler.h"
  27 #include "nsError.h"
  28 #include "nsIContentSecurityPolicy.h"
  29 #include "nsNetCID.h"
  30 #include "js/Wrapper.h"
  31
  32 #include "mozilla/dom/BlobURLProtocolHandler.h"
  33 #include "mozilla/dom/ScriptSettings.h"
  34 #include "mozilla/ClearOnShutdown.h"
  35 #include "mozilla/ExtensionPolicyService.h"
  36 #include "mozilla/Preferences.h"
  37 #include "mozilla/HashFunctions.h"
  38
  39 #include "nsSerializationHelper.h"
  40 #include "json/json.h"
  41
  42 using namespace mozilla;
  43
  44 static inline ExtensionPolicyService& EPS() {
  45   return ExtensionPolicyService::GetSingleton();
  46 }
  47
  48 NS_IMPL_CLASSINFO(ContentPrincipal, nullptr, nsIClassInfo::MAIN_THREAD_ONLY,
  49                   NS_PRINCIPAL_CID)
  50 NS_IMPL_QUERY_INTERFACE_CI(ContentPrincipal, nsIPrincipal, nsISerializable)
  51 NS_IMPL_CI_INTERFACE_GETTER(ContentPrincipal, nsIPrincipal, nsISerializable)
  52
  53 ContentPrincipal::ContentPrincipal() : BasePrincipal(eContentPrincipal) {}
  54
  55 ContentPrincipal::~ContentPrincipal() {}
  56
  57 nsresult ContentPrincipal::Init(nsIURI* aURI,
  58                                 const OriginAttributes& aOriginAttributes,
  59                                 const nsACString& aOriginNoSuffix) {
  60   NS_ENSURE_ARG(aURI);
  61
  62   // Assert that the URI we get here isn't any of the schemes that we know we
  63   // should not get here.  These schemes always either inherit their principal
  64   // or fall back to a null principal.  These are schemes which return
  65   // URI_INHERITS_SECURITY_CONTEXT from their protocol handler's
  66   // GetProtocolFlags function.
  67   bool hasFlag = false;
  68   Unused << hasFlag;  // silence possible compiler warnings.
  69   MOZ_DIAGNOSTIC_ASSERT(
  70       NS_SUCCEEDED(NS_URIChainHasFlags(
  71           aURI, nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT, &hasFlag)) &&
  72       !hasFlag);
  73
  74   mURI = aURI;
  75   FinishInit(aOriginNoSuffix, aOriginAttributes);
  76
  77   return NS_OK;
  78 }
  79
  80 nsresult ContentPrincipal::Init(ContentPrincipal* aOther,
  81                                 const OriginAttributes& aOriginAttributes) {
  82   NS_ENSURE_ARG(aOther);
  83
  84   mURI = aOther->mURI;
  85   FinishInit(aOther, aOriginAttributes);
  86
  87   mDomain = aOther->mDomain;
  88   mAddon = aOther->mAddon;
  89   return NS_OK;
  90 }
  91
  92 nsresult ContentPrincipal::GetScriptLocation(nsACString& aStr) {
  93   return mURI->GetSpec(aStr);
  94 }
  95
  96 /* static */
  97 nsresult ContentPrincipal::GenerateOriginNoSuffixFromURI(
  98     nsIURI* aURI, nsACString& aOriginNoSuffix) {
  99   if (!aURI) {
 100     return NS_ERROR_FAILURE;
 101   }
 102
 103   nsCOMPtr<nsIURI> origin = NS_GetInnermostURI(aURI);
 104   if (!origin) {
 105     return NS_ERROR_FAILURE;
 106   }
 107
 108   MOZ_ASSERT(!NS_IsAboutBlank(origin),
 109              "The inner URI for about:blank must be moz-safe-about:blank");
 110
 111   // Handle non-strict file:// uris.
 112   if (!nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
 113       NS_URIIsLocalFile(origin)) {
 114     // If strict file origin policy is not in effect, all local files are
 115     // considered to be same-origin, so return a known dummy origin here.
 116     aOriginNoSuffix.AssignLiteral("file://UNIVERSAL_FILE_URI_ORIGIN");
 117     return NS_OK;
 118   }
 119
 120   nsresult rv;
 121 // NB: This is only compiled for Thunderbird/Suite.
 122 #if IS_ORIGIN_IS_FULL_SPEC_DEFINED
 123   bool fullSpec = false;
 124   rv = NS_URIChainHasFlags(origin, nsIProtocolHandler::ORIGIN_IS_FULL_SPEC,
 125                            &fullSpec);
 126   NS_ENSURE_SUCCESS(rv, rv);
 127   if (fullSpec) {
 128     return origin->GetAsciiSpec(aOriginNoSuffix);
 129   }
 130 #endif
 131
 132   // We want the invariant that prinA.origin == prinB.origin i.f.f.
 133   // prinA.equals(prinB). However, this requires that we impose certain
 134   // constraints on the behavior and origin semantics of principals, and in
 135   // particular, forbid creating origin strings for principals whose equality
 136   // constraints are not expressible as strings (i.e. object equality).
 137   // Moreover, we want to forbid URIs containing the magic "^" we use as a
 138   // separating character for origin attributes.
 139   //
 140   // These constraints can generally be achieved by restricting .origin to
 141   // nsIStandardURL-based URIs, but there are a few other URI schemes that we
 142   // need to handle.
 143   if (origin->SchemeIs("about") ||
 144       (origin->SchemeIs("moz-safe-about") &&
 145        // We generally consider two about:foo origins to be same-origin, but
 146        // about:blank is special since it can be generated from different
 147        // sources. We check for moz-safe-about:blank since origin is an
 148        // innermost URI.
 149        !StringBeginsWith(origin->GetSpecOrDefault(),
 150                          "moz-safe-about:blank"_ns))) {
 151     rv = origin->GetAsciiSpec(aOriginNoSuffix);
 152     NS_ENSURE_SUCCESS(rv, rv);
 153
 154     int32_t pos = aOriginNoSuffix.FindChar('?');
 155     int32_t hashPos = aOriginNoSuffix.FindChar('#');
 156
 157     if (hashPos != kNotFound && (pos == kNotFound || hashPos < pos)) {
 158       pos = hashPos;
 159     }
 160
 161     if (pos != kNotFound) {
 162       aOriginNoSuffix.Truncate(pos);
 163     }
 164
 165     // These URIs could technically contain a '^', but they never should.
 166     if (NS_WARN_IF(aOriginNoSuffix.FindChar('^', 0) != -1)) {
 167       aOriginNoSuffix.Truncate();
 168       return NS_ERROR_FAILURE;
 169     }
 170     return NS_OK;
 171   }
 172
 173   // This URL can be a blobURL. In this case, we should use the 'parent'
 174   // principal instead.
 175   nsCOMPtr<nsIPrincipal> blobPrincipal;
 176   if (dom::BlobURLProtocolHandler::GetBlobURLPrincipal(
 177           origin, getter_AddRefs(blobPrincipal))) {
 178     MOZ_ASSERT(blobPrincipal);
 179     return blobPrincipal->GetOriginNoSuffix(aOriginNoSuffix);
 180   }
 181
 182   // If we reached this branch, we can only create an origin if we have a
 183   // nsIStandardURL.  So, we query to a nsIStandardURL, and fail if we aren't
 184   // an instance of an nsIStandardURL nsIStandardURLs have the good property
 185   // of escaping the '^' character in their specs, which means that we can be
 186   // sure that the caret character (which is reserved for delimiting the end
 187   // of the spec, and the beginning of the origin attributes) is not present
 188   // in the origin string
 189   nsCOMPtr<nsIStandardURL> standardURL = do_QueryInterface(origin);
 190   if (!standardURL) {
 191     return NS_ERROR_FAILURE;
 192   }
 193
 194   // See whether we have a useful hostPort. If we do, use that.
 195   nsAutoCString hostPort;
 196   if (!origin->SchemeIs("chrome")) {
 197     rv = origin->GetAsciiHostPort(hostPort);
 198     NS_ENSURE_SUCCESS(rv, rv);
 199   }
 200   if (!hostPort.IsEmpty()) {
 201     rv = origin->GetScheme(aOriginNoSuffix);
 202     NS_ENSURE_SUCCESS(rv, rv);
 203     aOriginNoSuffix.AppendLiteral("://");
 204     aOriginNoSuffix.Append(hostPort);
 205     return NS_OK;
 206   }
 207
 208   rv = aURI->GetAsciiSpec(aOriginNoSuffix);
 209   NS_ENSURE_SUCCESS(rv, rv);
 210
 211   // The origin, when taken from the spec, should not contain the ref part of
 212   // the URL.
 213
 214   int32_t pos = aOriginNoSuffix.FindChar('?');
 215   int32_t hashPos = aOriginNoSuffix.FindChar('#');
 216
 217   if (hashPos != kNotFound && (pos == kNotFound || hashPos < pos)) {
 218     pos = hashPos;
 219   }
 220
 221   if (pos != kNotFound) {
 222     aOriginNoSuffix.Truncate(pos);
 223   }
 224
 225   return NS_OK;
 226 }
 227
 228 bool ContentPrincipal::SubsumesInternal(
 229     nsIPrincipal* aOther,
 230     BasePrincipal::DocumentDomainConsideration aConsideration) {
 231   MOZ_ASSERT(aOther);
 232
 233   // For ContentPrincipal, Subsumes is equivalent to Equals.
 234   if (aOther == this) {
 235     return true;
 236   }
 237
 238   // If either the subject or the object has changed its principal by
 239   // explicitly setting document.domain then the other must also have
 240   // done so in order to be considered the same origin. This prevents
 241   // DNS spoofing based on document.domain (154930)
 242   nsresult rv;
 243   if (aConsideration == ConsiderDocumentDomain) {
 244     // Get .domain on each principal.
 245     nsCOMPtr<nsIURI> thisDomain, otherDomain;
 246     GetDomain(getter_AddRefs(thisDomain));
 247     aOther->GetDomain(getter_AddRefs(otherDomain));
 248
 249     // If either has .domain set, we have equality i.f.f. the domains match.
 250     // Otherwise, we fall through to the non-document-domain-considering case.
 251     if (thisDomain || otherDomain) {
 252       bool isMatch =
 253           nsScriptSecurityManager::SecurityCompareURIs(thisDomain, otherDomain);
 254 #ifdef DEBUG
 255       if (isMatch) {
 256         nsAutoCString thisSiteOrigin, otherSiteOrigin;
 257         MOZ_ALWAYS_SUCCEEDS(GetSiteOrigin(thisSiteOrigin));
 258         MOZ_ALWAYS_SUCCEEDS(aOther->GetSiteOrigin(otherSiteOrigin));
 259         MOZ_ASSERT(
 260             thisSiteOrigin == otherSiteOrigin,
 261             "SubsumesConsideringDomain passed with mismatched siteOrigin!");
 262       }
 263 #endif
 264       return isMatch;
 265     }
 266   }
 267
 268   // Compare uris.
 269   bool isSameOrigin = false;
 270   rv = aOther->IsSameOrigin(mURI, false, &isSameOrigin);
 271   NS_ENSURE_SUCCESS(rv, false);
 272   return isSameOrigin;
 273 }
 274
 275 NS_IMETHODIMP
 276 ContentPrincipal::GetURI(nsIURI** aURI) {
 277   NS_ADDREF(*aURI = mURI);
 278   return NS_OK;
 279 }
 280
 281 bool ContentPrincipal::MayLoadInternal(nsIURI* aURI) {
 282   MOZ_ASSERT(aURI);
 283
 284 #if defined(MOZ_THUNDERBIRD) || defined(MOZ_SUITE)
 285   nsCOMPtr<nsIURIWithSpecialOrigin> uriWithSpecialOrigin =
 286       do_QueryInterface(aURI);
 287   if (uriWithSpecialOrigin) {
 288     nsCOMPtr<nsIURI> origin;
 289     nsresult rv = uriWithSpecialOrigin->GetOrigin(getter_AddRefs(origin));
 290     if (NS_WARN_IF(NS_FAILED(rv))) {
 291       return false;
 292     }
 293     MOZ_ASSERT(origin);
 294     OriginAttributes attrs;
 295     RefPtr<BasePrincipal> principal =
 296         BasePrincipal::CreateContentPrincipal(origin, attrs);
 297     return nsIPrincipal::Subsumes(principal);
 298   }
 299 #endif
 300
 301   nsCOMPtr<nsIPrincipal> blobPrincipal;
 302   if (dom::BlobURLProtocolHandler::GetBlobURLPrincipal(
 303           aURI, getter_AddRefs(blobPrincipal))) {
 304     MOZ_ASSERT(blobPrincipal);
 305     return nsIPrincipal::Subsumes(blobPrincipal);
 306   }
 307
 308   // If this principal is associated with an addon, check whether that addon
 309   // has been given permission to load from this domain.
 310   if (AddonAllowsLoad(aURI)) {
 311     return true;
 312   }
 313
 314   if (nsScriptSecurityManager::SecurityCompareURIs(mURI, aURI)) {
 315     return true;
 316   }
 317
 318   // If strict file origin policy is in effect, local files will always fail
 319   // SecurityCompareURIs unless they are identical. Explicitly check file origin
 320   // policy, in that case.
 321   if (nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
 322       NS_URIIsLocalFile(aURI) && NS_RelaxStrictFileOriginPolicy(aURI, mURI)) {
 323     return true;
 324   }
 325
 326   return false;
 327 }
 328
 329 uint32_t ContentPrincipal::GetHashValue() {
 330   MOZ_ASSERT(mURI, "Need a principal URI");
 331
 332   nsCOMPtr<nsIURI> uri;
 333   GetDomain(getter_AddRefs(uri));
 334   if (!uri) {
 335     GetURI(getter_AddRefs(uri));
 336   };
 337   return NS_SecurityHashURI(uri);
 338 }
 339
 340 NS_IMETHODIMP
 341 ContentPrincipal::GetDomain(nsIURI** aDomain) {
 342   if (!mDomain) {
 343     *aDomain = nullptr;
 344     return NS_OK;
 345   }
 346
 347   NS_ADDREF(*aDomain = mDomain);
 348   return NS_OK;
 349 }
 350
 351 NS_IMETHODIMP
 352 ContentPrincipal::SetDomain(nsIURI* aDomain) {
 353   MOZ_ASSERT(aDomain);
 354
 355   mDomain = aDomain;
 356   SetHasExplicitDomain();
 357
 358   // Set the changed-document-domain flag on compartments containing realms
 359   // using this principal.
 360   auto cb = [](JSContext*, void*, JS::Realm* aRealm,
 361                const JS::AutoRequireNoGC& nogc) {
 362     JS::Compartment* comp = JS::GetCompartmentForRealm(aRealm);
 363     xpc::SetCompartmentChangedDocumentDomain(comp);
 364   };
 365   JSPrincipals* principals =
 366       nsJSPrincipals::get(static_cast<nsIPrincipal*>(this));
 367
 368   dom::AutoJSAPI jsapi;
 369   jsapi.Init();
 370   JS::IterateRealmsWithPrincipals(jsapi.cx(), principals, nullptr, cb);
 371
 372   return NS_OK;
 373 }
 374
 375 static nsresult GetSpecialBaseDomain(const nsCOMPtr<nsIURI>& aURI,
 376                                      bool* aHandled, nsACString& aBaseDomain) {
 377   *aHandled = false;
 378
 379   // Special handling for a file URI.
 380   if (NS_URIIsLocalFile(aURI)) {
 381     // If strict file origin policy is not in effect, all local files are
 382     // considered to be same-origin, so return a known dummy domain here.
 383     if (!nsScriptSecurityManager::GetStrictFileOriginPolicy()) {
 384       *aHandled = true;
 385       aBaseDomain.AssignLiteral("UNIVERSAL_FILE_URI_ORIGIN");
 386       return NS_OK;
 387     }
 388
 389     // Otherwise, we return the file path.
 390     nsCOMPtr<nsIURL> url = do_QueryInterface(aURI);
 391
 392     if (url) {
 393       *aHandled = true;
 394       return url->GetFilePath(aBaseDomain);
 395     }
 396   }
 397
 398   bool hasNoRelativeFlag;
 399   nsresult rv = NS_URIChainHasFlags(aURI, nsIProtocolHandler::URI_NORELATIVE,
 400                                     &hasNoRelativeFlag);
 401   if (NS_WARN_IF(NS_FAILED(rv))) {
 402     return rv;
 403   }
 404
 405   // In case of FTP we want to get base domain via TLD service even if FTP
 406   // protocol handler is disabled and the scheme is handled by external protocol
 407   // handler which returns URI_NORELATIVE flag.
 408   if (hasNoRelativeFlag && !aURI->SchemeIs("ftp")) {
 409     *aHandled = true;
 410     return aURI->GetSpec(aBaseDomain);
 411   }
 412
 413   if (aURI->SchemeIs("indexeddb")) {
 414     *aHandled = true;
 415     return aURI->GetSpec(aBaseDomain);
 416   }
 417
 418   return NS_OK;
 419 }
 420
 421 NS_IMETHODIMP
 422 ContentPrincipal::GetBaseDomain(nsACString& aBaseDomain) {
 423   // Handle some special URIs first.
 424   bool handled;
 425   nsresult rv = GetSpecialBaseDomain(mURI, &handled, aBaseDomain);
 426   NS_ENSURE_SUCCESS(rv, rv);
 427
 428   if (handled) {
 429     return NS_OK;
 430   }
 431
 432   // For everything else, we ask the TLD service via the ThirdPartyUtil.
 433   nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
 434       do_GetService(THIRDPARTYUTIL_CONTRACTID);
 435   if (!thirdPartyUtil) {
 436     return NS_ERROR_FAILURE;
 437   }
 438
 439   return thirdPartyUtil->GetBaseDomain(mURI, aBaseDomain);
 440 }
 441
 442 NS_IMETHODIMP
 443 ContentPrincipal::GetSiteOrigin(nsACString& aSiteOrigin) {
 444   // Handle some special URIs first.
 445   nsAutoCString baseDomain;
 446   bool handled;
 447   nsresult rv = GetSpecialBaseDomain(mURI, &handled, baseDomain);
 448   NS_ENSURE_SUCCESS(rv, rv);
 449
 450   if (handled) {
 451     // This is a special URI ("file:", "about:", "view-source:", etc). Just
 452     // return the origin.
 453     return GetOrigin(aSiteOrigin);
 454   }
 455
 456   // For everything else, we ask the TLD service. Note that, unlike in
 457   // GetBaseDomain, we don't use ThirdPartyUtil.getBaseDomain because if the
 458   // host is an IP address that returns the raw address and we can't use it with
 459   // SetHost below because SetHost expects '[' and ']' around IPv6 addresses.
 460   // See bug 1491728.
 461   nsCOMPtr<nsIEffectiveTLDService> tldService =
 462       do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
 463   if (!tldService) {
 464     return NS_ERROR_FAILURE;
 465   }
 466
 467   bool gotBaseDomain = false;
 468   rv = tldService->GetBaseDomain(mURI, 0, baseDomain);
 469   if (NS_SUCCEEDED(rv)) {
 470     gotBaseDomain = true;
 471   } else {
 472     // If this is an IP address or something like "localhost", we just continue
 473     // with gotBaseDomain = false.
 474     if (rv != NS_ERROR_HOST_IS_IP_ADDRESS &&
 475         rv != NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
 476       return rv;
 477     }
 478   }
 479
 480   // NOTE: Calling `SetHostPort` with a portless domain is insufficient to clear
 481   // the port, so an extra `SetPort` call has to be made.
 482   nsCOMPtr<nsIURI> siteUri;
 483   NS_MutateURI mutator(mURI);
 484   mutator.SetUserPass(EmptyCString()).SetPort(-1);
 485   if (gotBaseDomain) {
 486     mutator.SetHost(baseDomain);
 487   }
 488   rv = mutator.Finalize(siteUri);
 489   MOZ_ASSERT(NS_SUCCEEDED(rv), "failed to create siteUri");
 490   NS_ENSURE_SUCCESS(rv, rv);
 491
 492   rv = GenerateOriginNoSuffixFromURI(siteUri, aSiteOrigin);
 493   MOZ_ASSERT(NS_SUCCEEDED(rv), "failed to create siteOriginNoSuffix");
 494   NS_ENSURE_SUCCESS(rv, rv);
 495
 496   nsAutoCString suffix;
 497   rv = GetOriginSuffix(suffix);
 498   MOZ_ASSERT(NS_SUCCEEDED(rv), "failed to create suffix");
 499   NS_ENSURE_SUCCESS(rv, rv);
 500
 501   aSiteOrigin.Append(suffix);
 502   return NS_OK;
 503 }
 504
 505 nsresult ContentPrincipal::GetSiteIdentifier(SiteIdentifier& aSite) {
 506   nsCString siteOrigin;
 507   nsresult rv = GetSiteOrigin(siteOrigin);
 508   NS_ENSURE_SUCCESS(rv, rv);
 509
 510   RefPtr<BasePrincipal> principal = CreateContentPrincipal(siteOrigin);
 511   if (!principal) {
 512     NS_WARNING("could not instantiate content principal");
 513     return NS_ERROR_FAILURE;
 514   }
 515
 516   aSite.Init(principal);
 517   return NS_OK;
 518 }
 519
 520 WebExtensionPolicy* ContentPrincipal::AddonPolicy() {
 521   if (!mAddon.isSome()) {
 522     NS_ENSURE_TRUE(mURI, nullptr);
 523
 524     if (mURI->SchemeIs("moz-extension")) {
 525       mAddon.emplace(EPS().GetByURL(mURI.get()));
 526     } else {
 527       mAddon.emplace(nullptr);
 528     }
 529   }
 530
 531   return mAddon.value();
 532 }
 533
 534 NS_IMETHODIMP
 535 ContentPrincipal::GetAddonId(nsAString& aAddonId) {
 536   auto policy = AddonPolicy();
 537   if (policy) {
 538     policy->GetId(aAddonId);
 539   } else {
 540     aAddonId.Truncate();
 541   }
 542   return NS_OK;
 543 }
 544
 545 NS_IMETHODIMP
 546 ContentPrincipal::Read(nsIObjectInputStream* aStream) {
 547   nsCOMPtr<nsISupports> supports;
 548   nsCOMPtr<nsIURI> principalURI;
 549   nsresult rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 550   if (NS_FAILED(rv)) {
 551     return rv;
 552   }
 553
 554   principalURI = do_QueryInterface(supports);
 555   // Enforce re-parsing about: URIs so that if they change, we continue to use
 556   // their new principals correctly.
 557   if (principalURI->SchemeIs("about")) {
 558     nsAutoCString spec;
 559     principalURI->GetSpec(spec);
 560     NS_ENSURE_SUCCESS(NS_NewURI(getter_AddRefs(principalURI), spec),
 561                       NS_ERROR_FAILURE);
 562   }
 563
 564   nsCOMPtr<nsIURI> domain;
 565   rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 566   if (NS_FAILED(rv)) {
 567     return rv;
 568   }
 569
 570   domain = do_QueryInterface(supports);
 571
 572   nsAutoCString suffix;
 573   rv = aStream->ReadCString(suffix);
 574   NS_ENSURE_SUCCESS(rv, rv);
 575
 576   OriginAttributes attrs;
 577   bool ok = attrs.PopulateFromSuffix(suffix);
 578   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 579
 580   // Since Bug 965637 we do not serialize the CSP within the
 581   // Principal anymore. Nevertheless there might still be
 582   // serialized Principals that do have a serialized CSP.
 583   // For now, we just read the CSP here but do not actually
 584   // consume it. Please note that we deliberately ignore
 585   // the return value to avoid CSP deserialization problems.
 586   // After Bug 1508939 we will have a new serialization for
 587   // Principals which allows us to update the code here.
 588   // Additionally, the format for serialized CSPs changed
 589   // within Bug 965637 which also can cause failures within
 590   // the CSP deserialization code.
 591   Unused << NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 592
 593   nsAutoCString originNoSuffix;
 594   rv = GenerateOriginNoSuffixFromURI(principalURI, originNoSuffix);
 595   NS_ENSURE_SUCCESS(rv, rv);
 596
 597   rv = Init(principalURI, attrs, originNoSuffix);
 598   NS_ENSURE_SUCCESS(rv, rv);
 599
 600   // Note: we don't call SetDomain here because we don't need the wrapper
 601   // recomputation code there (we just created this principal).
 602   mDomain = domain;
 603   if (mDomain) {
 604     SetHasExplicitDomain();
 605   }
 606
 607   return NS_OK;
 608 }
 609
 610 NS_IMETHODIMP
 611 ContentPrincipal::Write(nsIObjectOutputStream* aStream) {
 612   // Read is used still for legacy principals
 613   MOZ_RELEASE_ASSERT(false, "Old style serialization is removed");
 614   return NS_OK;
 615 }
 616
 617 nsresult ContentPrincipal::PopulateJSONObject(Json::Value& aObject) {
 618   nsAutoCString principalURI;
 619   nsresult rv = mURI->GetSpec(principalURI);
 620   NS_ENSURE_SUCCESS(rv, rv);
 621
 622   // We turn each int enum field into a JSON string key of the object
 623   // aObject is the inner JSON object that has stringified enum keys
 624   // An example aObject might be:
 625   //
 626   // eURI                   eSuffix
 627   //    |                           |
 628   //  {"0": "https://mozilla.com", "2": "^privateBrowsingId=1"}
 629   //    |                |          |         |
 630   //    -----------------------------         |
 631   //         |           |                    |
 632   //        Key          ----------------------
 633   //                                |
 634   //                              Value
 635   aObject[std::to_string(eURI)] = principalURI.get();
 636
 637   if (mDomain) {
 638     nsAutoCString domainStr;
 639     rv = mDomain->GetSpec(domainStr);
 640     NS_ENSURE_SUCCESS(rv, rv);
 641     aObject[std::to_string(eDomain)] = domainStr.get();
 642   }
 643
 644   nsAutoCString suffix;
 645   OriginAttributesRef().CreateSuffix(suffix);
 646   if (suffix.Length() > 0) {
 647     aObject[std::to_string(eSuffix)] = suffix.get();
 648   }
 649
 650   return NS_OK;
 651 }
 652
 653 already_AddRefed<BasePrincipal> ContentPrincipal::FromProperties(
 654     nsTArray<ContentPrincipal::KeyVal>& aFields) {
 655   MOZ_ASSERT(aFields.Length() == eMax + 1, "Must have all the keys");
 656   nsresult rv;
 657   nsCOMPtr<nsIURI> principalURI;
 658   nsCOMPtr<nsIURI> domain;
 659   nsCOMPtr<nsIContentSecurityPolicy> csp;
 660   OriginAttributes attrs;
 661
 662   // The odd structure here is to make the code to not compile
 663   // if all the switch enum cases haven't been codified
 664   for (const auto& field : aFields) {
 665     switch (field.key) {
 666       case ContentPrincipal::eURI:
 667         if (!field.valueWasSerialized) {
 668           MOZ_ASSERT(
 669               false,
 670               "Content principals require a principal URI in serialized JSON");
 671           return nullptr;
 672         }
 673         rv = NS_NewURI(getter_AddRefs(principalURI), field.value.get());
 674         NS_ENSURE_SUCCESS(rv, nullptr);
 675
 676         {
 677           // Enforce re-parsing about: URIs so that if they change, we
 678           // continue to use their new principals correctly.
 679           if (principalURI->SchemeIs("about")) {
 680             nsAutoCString spec;
 681             principalURI->GetSpec(spec);
 682             if (NS_FAILED(NS_NewURI(getter_AddRefs(principalURI), spec))) {
 683               return nullptr;
 684             }
 685           }
 686         }
 687         break;
 688       case ContentPrincipal::eDomain:
 689         if (field.valueWasSerialized) {
 690           rv = NS_NewURI(getter_AddRefs(domain), field.value.get());
 691           NS_ENSURE_SUCCESS(rv, nullptr);
 692         }
 693         break;
 694       case ContentPrincipal::eSuffix:
 695         if (field.valueWasSerialized) {
 696           bool ok = attrs.PopulateFromSuffix(field.value);
 697           if (!ok) {
 698             return nullptr;
 699           }
 700         }
 701         break;
 702     }
 703   }
 704   nsAutoCString originNoSuffix;
 705   rv = ContentPrincipal::GenerateOriginNoSuffixFromURI(principalURI,
 706                                                        originNoSuffix);
 707   if (NS_FAILED(rv)) {
 708     return nullptr;
 709   }
 710
 711   RefPtr<ContentPrincipal> principal = new ContentPrincipal();
 712   rv = principal->Init(principalURI, attrs, originNoSuffix);
 713   if (NS_FAILED(rv)) {
 714     return nullptr;
 715   }
 716
 717   principal->mDomain = domain;
 718   if (principal->mDomain) {
 719     principal->SetHasExplicitDomain();
 720   }
 721
 722   return principal.forget();
 723 }