caps/BasePrincipal.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef mozilla_BasePrincipal_h
   8 #define mozilla_BasePrincipal_h
   9
  10 #include "nsJSPrincipals.h"
  11
  12 #include "mozilla/Attributes.h"
  13 #include "mozilla/OriginAttributes.h"
  14
  15 class nsAtom;
  16 class nsIContentSecurityPolicy;
  17 class nsIObjectOutputStream;
  18 class nsIObjectInputStream;
  19 class nsIURI;
  20
  21 class ExpandedPrincipal;
  22
  23 namespace Json {
  24 class Value;
  25 }
  26 namespace mozilla {
  27 namespace dom {
  28 class Document;
  29 }
  30 namespace extensions {
  31 class WebExtensionPolicy;
  32 }
  33
  34 class BasePrincipal;
  35
  36 // Content principals (and content principals embedded within expanded
  37 // principals) stored in SiteIdentifier are guaranteed to contain only the
  38 // eTLD+1 part of the original domain. This is used to determine whether two
  39 // origins are same-site: if it's possible for two origins to access each other
  40 // (maybe after mutating document.domain), then they must have the same site
  41 // identifier.
  42 class SiteIdentifier {
  43  public:
  44   void Init(BasePrincipal* aPrincipal) {
  45     MOZ_ASSERT(aPrincipal);
  46     mPrincipal = aPrincipal;
  47   }
  48
  49   bool IsInitialized() const { return !!mPrincipal; }
  50
  51   bool Equals(const SiteIdentifier& aOther) const;
  52
  53  private:
  54   friend class ::ExpandedPrincipal;
  55
  56   BasePrincipal* GetPrincipal() const {
  57     MOZ_ASSERT(IsInitialized());
  58     return mPrincipal;
  59   }
  60
  61   RefPtr<BasePrincipal> mPrincipal;
  62 };
  63
  64 /*
  65  * Base class from which all nsIPrincipal implementations inherit. Use this for
  66  * default implementations and other commonalities between principal
  67  * implementations.
  68  *
  69  * We should merge nsJSPrincipals into this class at some point.
  70  */
  71 class BasePrincipal : public nsJSPrincipals {
  72  public:
  73   // Warning: this enum impacts Principal serialization into JSON format.
  74   // Only update if you know exactly what you are doing
  75   enum PrincipalKind {
  76     eNullPrincipal = 0,
  77     eContentPrincipal,
  78     eExpandedPrincipal,
  79     eSystemPrincipal,
  80     eKindMax = eSystemPrincipal
  81   };
  82
  83   explicit BasePrincipal(PrincipalKind aKind);
  84
  85   template <typename T>
  86   bool Is() const {
  87     return mKind == T::Kind();
  88   }
  89
  90   template <typename T>
  91   T* As() {
  92     MOZ_ASSERT(Is<T>());
  93     return static_cast<T*>(this);
  94   }
  95
  96   enum DocumentDomainConsideration {
  97     DontConsiderDocumentDomain,
  98     ConsiderDocumentDomain
  99   };
 100   bool Subsumes(nsIPrincipal* aOther,
 101                 DocumentDomainConsideration aConsideration);
 102
 103   NS_IMETHOD GetOrigin(nsACString& aOrigin) final;
 104   NS_IMETHOD GetOriginNoSuffix(nsACString& aOrigin) final;
 105   NS_IMETHOD Equals(nsIPrincipal* other, bool* _retval) final;
 106   NS_IMETHOD EqualsConsideringDomain(nsIPrincipal* other, bool* _retval) final;
 107   NS_IMETHOD Subsumes(nsIPrincipal* other, bool* _retval) final;
 108   NS_IMETHOD SubsumesConsideringDomain(nsIPrincipal* other,
 109                                        bool* _retval) final;
 110   NS_IMETHOD SubsumesConsideringDomainIgnoringFPD(nsIPrincipal* other,
 111                                                   bool* _retval) final;
 112   NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report,
 113                           bool allowIfInheritsPrincipal) final;
 114   NS_IMETHOD GetAddonPolicy(nsISupports** aResult) final;
 115   NS_IMETHOD GetIsNullPrincipal(bool* aResult) override;
 116   NS_IMETHOD GetIsContentPrincipal(bool* aResult) override;
 117   NS_IMETHOD GetIsExpandedPrincipal(bool* aResult) override;
 118   NS_IMETHOD GetIsSystemPrincipal(bool* aResult) override;
 119   NS_IMETHOD GetIsAddonOrExpandedAddonPrincipal(bool* aResult) override;
 120   NS_IMETHOD GetOriginAttributes(JSContext* aCx,
 121                                  JS::MutableHandle<JS::Value> aVal) final;
 122   NS_IMETHOD GetOriginSuffix(nsACString& aOriginSuffix) final;
 123   NS_IMETHOD GetIsInIsolatedMozBrowserElement(
 124       bool* aIsInIsolatedMozBrowserElement) final;
 125   NS_IMETHOD GetUserContextId(uint32_t* aUserContextId) final;
 126   NS_IMETHOD GetPrivateBrowsingId(uint32_t* aPrivateBrowsingId) final;
 127   NS_IMETHOD GetSiteOrigin(nsACString& aOrigin) override;
 128
 129   nsresult ToJSON(nsACString& aJSON);
 130   static already_AddRefed<BasePrincipal> FromJSON(const nsACString& aJSON);
 131   // Method populates a passed Json::Value with serializable fields
 132   // which represent all of the fields to deserialize the principal
 133   virtual nsresult PopulateJSONObject(Json::Value& aObject);
 134
 135   virtual bool AddonHasPermission(const nsAtom* aPerm);
 136
 137   virtual bool IsContentPrincipal() const { return false; };
 138
 139   static BasePrincipal* Cast(nsIPrincipal* aPrin) {
 140     return static_cast<BasePrincipal*>(aPrin);
 141   }
 142
 143   static const BasePrincipal* Cast(const nsIPrincipal* aPrin) {
 144     return static_cast<const BasePrincipal*>(aPrin);
 145   }
 146
 147   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 148       const nsACString& aOrigin);
 149
 150   // These following method may not create a content principal in case it's
 151   // not possible to generate a correct origin from the passed URI. If this
 152   // happens, a NullPrincipal is returned.
 153
 154   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 155       nsIURI* aURI, const OriginAttributes& aAttrs);
 156
 157   const OriginAttributes& OriginAttributesRef() final {
 158     return mOriginAttributes;
 159   }
 160   extensions::WebExtensionPolicy* AddonPolicy();
 161   uint32_t UserContextId() const { return mOriginAttributes.mUserContextId; }
 162   uint32_t PrivateBrowsingId() const {
 163     return mOriginAttributes.mPrivateBrowsingId;
 164   }
 165   bool IsInIsolatedMozBrowserElement() const {
 166     return mOriginAttributes.mInIsolatedMozBrowser;
 167   }
 168
 169   PrincipalKind Kind() const { return mKind; }
 170
 171   already_AddRefed<BasePrincipal> CloneForcingOriginAttributes(
 172       const OriginAttributes& aOriginAttributes);
 173
 174   // If this is an add-on content script principal, returns its AddonPolicy.
 175   // Otherwise returns null.
 176   extensions::WebExtensionPolicy* ContentScriptAddonPolicy();
 177
 178   // Helper to check whether this principal is associated with an addon that
 179   // allows unprivileged code to load aURI.  aExplicit == true will prevent
 180   // use of all_urls permission, requiring the domain in its permissions.
 181   bool AddonAllowsLoad(nsIURI* aURI, bool aExplicit = false);
 182
 183   // Call these to avoid the cost of virtual dispatch.
 184   inline bool FastEquals(nsIPrincipal* aOther);
 185   inline bool FastEqualsConsideringDomain(nsIPrincipal* aOther);
 186   inline bool FastSubsumes(nsIPrincipal* aOther);
 187   inline bool FastSubsumesConsideringDomain(nsIPrincipal* aOther);
 188   inline bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther);
 189   inline bool FastSubsumesConsideringDomainIgnoringFPD(nsIPrincipal* aOther);
 190
 191   // Fast way to check whether we have a system principal.
 192   inline bool IsSystemPrincipal() const;
 193
 194   // Returns the principal to inherit when a caller with this principal loads
 195   // the given URI.
 196   //
 197   // For most principal types, this returns the principal itself. For expanded
 198   // principals, it returns the first sub-principal which subsumes the given URI
 199   // (or, if no URI is given, the last allowlist principal).
 200   nsIPrincipal* PrincipalToInherit(nsIURI* aRequestedURI = nullptr);
 201
 202   /* Returns true if this principal's CSP should override a document's CSP for
 203    * loads that it triggers. Currently true for expanded principals which
 204    * subsume the document principal, and add-on content principals regardless
 205    * of whether they subsume the document principal.
 206    */
 207   bool OverridesCSP(nsIPrincipal* aDocumentPrincipal) {
 208     // Expanded principals override CSP if and only if they subsume the document
 209     // principal.
 210     if (mKind == eExpandedPrincipal) {
 211       return FastSubsumes(aDocumentPrincipal);
 212     }
 213     // Extension principals always override the CSP non-extension principals.
 214     // This is primarily for the sake of their stylesheets, which are usually
 215     // loaded from channels and cannot have expanded principals.
 216     return (AddonPolicy() &&
 217             !BasePrincipal::Cast(aDocumentPrincipal)->AddonPolicy());
 218   }
 219
 220   uint32_t GetOriginNoSuffixHash() const { return mOriginNoSuffix->hash(); }
 221   uint32_t GetOriginSuffixHash() const { return mOriginSuffix->hash(); }
 222
 223   virtual nsresult GetSiteIdentifier(SiteIdentifier& aSite) = 0;
 224
 225  protected:
 226   virtual ~BasePrincipal();
 227
 228   // Note that this does not check OriginAttributes. Callers that depend on
 229   // those must call Subsumes instead.
 230   virtual bool SubsumesInternal(nsIPrincipal* aOther,
 231                                 DocumentDomainConsideration aConsider) = 0;
 232
 233   // Internal, side-effect-free check to determine whether the concrete
 234   // principal would allow the load ignoring any common behavior implemented in
 235   // BasePrincipal::CheckMayLoad.
 236   virtual bool MayLoadInternal(nsIURI* aURI) = 0;
 237   friend class ::ExpandedPrincipal;
 238
 239   void SetHasExplicitDomain() { mHasExplicitDomain = true; }
 240
 241   // Either of these functions should be called as the last step of the
 242   // initialization of the principal objects.  It's typically called as the
 243   // last step from the Init() method of the child classes.
 244   void FinishInit(const nsACString& aOriginNoSuffix,
 245                   const OriginAttributes& aOriginAttributes);
 246   void FinishInit(BasePrincipal* aOther,
 247                   const OriginAttributes& aOriginAttributes);
 248
 249  private:
 250   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 251       nsIURI* aURI, const OriginAttributes& aAttrs,
 252       const nsACString& aOriginNoSuffix);
 253
 254   inline bool FastSubsumesIgnoringFPD(
 255       nsIPrincipal* aOther, DocumentDomainConsideration aConsideration);
 256
 257   RefPtr<nsAtom> mOriginNoSuffix;
 258   RefPtr<nsAtom> mOriginSuffix;
 259
 260   OriginAttributes mOriginAttributes;
 261   PrincipalKind mKind;
 262   bool mHasExplicitDomain;
 263   bool mInitialized;
 264 };
 265
 266 inline bool BasePrincipal::FastEquals(nsIPrincipal* aOther) {
 267   auto other = Cast(aOther);
 268   if (Kind() != other->Kind()) {
 269     // Principals of different kinds can't be equal.
 270     return false;
 271   }
 272
 273   // Two principals are considered to be equal if their origins are the same.
 274   // If the two principals are content principals, their origin attributes
 275   // (aka the origin suffix) must also match.
 276   if (Kind() == eSystemPrincipal) {
 277     return this == other;
 278   }
 279
 280   if (Kind() == eContentPrincipal || Kind() == eNullPrincipal) {
 281     return mOriginNoSuffix == other->mOriginNoSuffix &&
 282            mOriginSuffix == other->mOriginSuffix;
 283   }
 284
 285   MOZ_ASSERT(Kind() == eExpandedPrincipal);
 286   return mOriginNoSuffix == other->mOriginNoSuffix;
 287 }
 288
 289 inline bool BasePrincipal::FastEqualsConsideringDomain(nsIPrincipal* aOther) {
 290   // If neither of the principals have document.domain set, we use the fast path
 291   // in Equals().  Otherwise, we fall back to the slow path below.
 292   auto other = Cast(aOther);
 293   if (!mHasExplicitDomain && !other->mHasExplicitDomain) {
 294     return FastEquals(aOther);
 295   }
 296
 297   return Subsumes(aOther, ConsiderDocumentDomain) &&
 298          other->Subsumes(this, ConsiderDocumentDomain);
 299 }
 300
 301 inline bool BasePrincipal::FastSubsumes(nsIPrincipal* aOther) {
 302   // If two principals are equal, then they both subsume each other.
 303   if (FastEquals(aOther)) {
 304     return true;
 305   }
 306
 307   // Otherwise, fall back to the slow path.
 308   return Subsumes(aOther, DontConsiderDocumentDomain);
 309 }
 310
 311 inline bool BasePrincipal::FastSubsumesConsideringDomain(nsIPrincipal* aOther) {
 312   // If neither of the principals have document.domain set, we hand off to
 313   // FastSubsumes() which has fast paths for some special cases. Otherwise, we
 314   // fall back to the slow path below.
 315   if (!mHasExplicitDomain && !Cast(aOther)->mHasExplicitDomain) {
 316     return FastSubsumes(aOther);
 317   }
 318
 319   return Subsumes(aOther, ConsiderDocumentDomain);
 320 }
 321
 322 inline bool BasePrincipal::FastSubsumesIgnoringFPD(
 323     nsIPrincipal* aOther, DocumentDomainConsideration aConsideration) {
 324   if (Kind() == eContentPrincipal &&
 325       !dom::ChromeUtils::IsOriginAttributesEqualIgnoringFPD(
 326           mOriginAttributes, Cast(aOther)->mOriginAttributes)) {
 327     return false;
 328   }
 329
 330   return SubsumesInternal(aOther, aConsideration);
 331 }
 332
 333 inline bool BasePrincipal::FastSubsumesIgnoringFPD(nsIPrincipal* aOther) {
 334   return FastSubsumesIgnoringFPD(aOther, DontConsiderDocumentDomain);
 335 }
 336
 337 inline bool BasePrincipal::FastSubsumesConsideringDomainIgnoringFPD(
 338     nsIPrincipal* aOther) {
 339   return FastSubsumesIgnoringFPD(aOther, ConsiderDocumentDomain);
 340 }
 341
 342 inline bool BasePrincipal::IsSystemPrincipal() const {
 343   return Kind() == eSystemPrincipal;
 344 }
 345
 346 }  // namespace mozilla
 347
 348 inline bool nsIPrincipal::IsSystemPrincipal() const {
 349   return mozilla::BasePrincipal::Cast(this)->IsSystemPrincipal();
 350 }
 351
 352 #endif /* mozilla_BasePrincipal_h */