caps/ContentPrincipal.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=2 sw=2 et tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ContentPrincipal.h"
   8
   9 #include "mozIThirdPartyUtil.h"
  10 #include "nsContentUtils.h"
  11 #include "nscore.h"
  12 #include "nsScriptSecurityManager.h"
  13 #include "nsString.h"
  14 #include "nsReadableUtils.h"
  15 #include "pratom.h"
  16 #include "nsIURI.h"
  17 #include "nsIURL.h"
  18 #include "nsIStandardURL.h"
  19 #include "nsIURIWithSpecialOrigin.h"
  20 #include "nsIURIMutator.h"
  21 #include "nsJSPrincipals.h"
  22 #include "nsIEffectiveTLDService.h"
  23 #include "nsIClassInfoImpl.h"
  24 #include "nsIObjectInputStream.h"
  25 #include "nsIObjectOutputStream.h"
  26 #include "nsIProtocolHandler.h"
  27 #include "nsError.h"
  28 #include "nsIContentSecurityPolicy.h"
  29 #include "nsNetCID.h"
  30 #include "js/RealmIterators.h"
  31 #include "js/Wrapper.h"
  32
  33 #include "mozilla/dom/BlobURLProtocolHandler.h"
  34 #include "mozilla/dom/ScriptSettings.h"
  35 #include "mozilla/ClearOnShutdown.h"
  36 #include "mozilla/ExtensionPolicyService.h"
  37 #include "mozilla/Preferences.h"
  38 #include "mozilla/HashFunctions.h"
  39
  40 #include "nsSerializationHelper.h"
  41 #include "json/json.h"
  42
  43 using namespace mozilla;
  44
  45 static inline ExtensionPolicyService& EPS() {
  46   return ExtensionPolicyService::GetSingleton();
  47 }
  48
  49 NS_IMPL_CLASSINFO(ContentPrincipal, nullptr, nsIClassInfo::MAIN_THREAD_ONLY,
  50                   NS_PRINCIPAL_CID)
  51 NS_IMPL_QUERY_INTERFACE_CI(ContentPrincipal, nsIPrincipal)
  52 NS_IMPL_CI_INTERFACE_GETTER(ContentPrincipal, nsIPrincipal)
  53
  54 ContentPrincipal::ContentPrincipal(nsIURI* aURI,
  55                                    const OriginAttributes& aOriginAttributes,
  56                                    const nsACString& aOriginNoSuffix)
  57     : BasePrincipal(eContentPrincipal, aOriginNoSuffix, aOriginAttributes),
  58       mURI(aURI) {
  59 #ifdef MOZ_DIAGNOSTIC_ASSERT_ENABLED
  60   // Assert that the URI we get here isn't any of the schemes that we know we
  61   // should not get here.  These schemes always either inherit their principal
  62   // or fall back to a null principal.  These are schemes which return
  63   // URI_INHERITS_SECURITY_CONTEXT from their protocol handler's
  64   // GetProtocolFlags function.
  65   bool hasFlag = false;
  66   MOZ_DIAGNOSTIC_ASSERT(
  67       NS_SUCCEEDED(NS_URIChainHasFlags(
  68           aURI, nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT, &hasFlag)) &&
  69       !hasFlag);
  70 #endif
  71 }
  72
  73 ContentPrincipal::ContentPrincipal(ContentPrincipal* aOther,
  74                                    const OriginAttributes& aOriginAttributes)
  75     : BasePrincipal(aOther, aOriginAttributes),
  76       mURI(aOther->mURI),
  77       mDomain(aOther->mDomain),
  78       mAddon(aOther->mAddon) {}
  79
  80 ContentPrincipal::~ContentPrincipal() = default;
  81
  82 nsresult ContentPrincipal::GetScriptLocation(nsACString& aStr) {
  83   return mURI->GetSpec(aStr);
  84 }
  85
  86 /* static */
  87 nsresult ContentPrincipal::GenerateOriginNoSuffixFromURI(
  88     nsIURI* aURI, nsACString& aOriginNoSuffix) {
  89   if (!aURI) {
  90     return NS_ERROR_FAILURE;
  91   }
  92
  93   nsCOMPtr<nsIURI> origin = NS_GetInnermostURI(aURI);
  94   if (!origin) {
  95     return NS_ERROR_FAILURE;
  96   }
  97
  98   MOZ_ASSERT(!NS_IsAboutBlank(origin),
  99              "The inner URI for about:blank must be moz-safe-about:blank");
 100
 101   // Handle non-strict file:// uris.
 102   if (!nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
 103       NS_URIIsLocalFile(origin)) {
 104     // If strict file origin policy is not in effect, all local files are
 105     // considered to be same-origin, so return a known dummy origin here.
 106     aOriginNoSuffix.AssignLiteral("file://UNIVERSAL_FILE_URI_ORIGIN");
 107     return NS_OK;
 108   }
 109
 110   nsresult rv;
 111 // NB: This is only compiled for Thunderbird/Suite.
 112 #if IS_ORIGIN_IS_FULL_SPEC_DEFINED
 113   bool fullSpec = false;
 114   rv = NS_URIChainHasFlags(origin, nsIProtocolHandler::ORIGIN_IS_FULL_SPEC,
 115                            &fullSpec);
 116   NS_ENSURE_SUCCESS(rv, rv);
 117   if (fullSpec) {
 118     return origin->GetAsciiSpec(aOriginNoSuffix);
 119   }
 120 #endif
 121
 122   // We want the invariant that prinA.origin == prinB.origin i.f.f.
 123   // prinA.equals(prinB). However, this requires that we impose certain
 124   // constraints on the behavior and origin semantics of principals, and in
 125   // particular, forbid creating origin strings for principals whose equality
 126   // constraints are not expressible as strings (i.e. object equality).
 127   // Moreover, we want to forbid URIs containing the magic "^" we use as a
 128   // separating character for origin attributes.
 129   //
 130   // These constraints can generally be achieved by restricting .origin to
 131   // nsIStandardURL-based URIs, but there are a few other URI schemes that we
 132   // need to handle.
 133   if (origin->SchemeIs("about") ||
 134       (origin->SchemeIs("moz-safe-about") &&
 135        // We generally consider two about:foo origins to be same-origin, but
 136        // about:blank is special since it can be generated from different
 137        // sources. We check for moz-safe-about:blank since origin is an
 138        // innermost URI.
 139        !StringBeginsWith(origin->GetSpecOrDefault(),
 140                          "moz-safe-about:blank"_ns))) {
 141     rv = origin->GetAsciiSpec(aOriginNoSuffix);
 142     NS_ENSURE_SUCCESS(rv, rv);
 143
 144     int32_t pos = aOriginNoSuffix.FindChar('?');
 145     int32_t hashPos = aOriginNoSuffix.FindChar('#');
 146
 147     if (hashPos != kNotFound && (pos == kNotFound || hashPos < pos)) {
 148       pos = hashPos;
 149     }
 150
 151     if (pos != kNotFound) {
 152       aOriginNoSuffix.Truncate(pos);
 153     }
 154
 155     // These URIs could technically contain a '^', but they never should.
 156     if (NS_WARN_IF(aOriginNoSuffix.FindChar('^', 0) != -1)) {
 157       aOriginNoSuffix.Truncate();
 158       return NS_ERROR_FAILURE;
 159     }
 160     return NS_OK;
 161   }
 162
 163   // This URL can be a blobURL. In this case, we should use the 'parent'
 164   // principal instead.
 165   nsCOMPtr<nsIPrincipal> blobPrincipal;
 166   if (dom::BlobURLProtocolHandler::GetBlobURLPrincipal(
 167           origin, getter_AddRefs(blobPrincipal))) {
 168     MOZ_ASSERT(blobPrincipal);
 169     return blobPrincipal->GetOriginNoSuffix(aOriginNoSuffix);
 170   }
 171
 172   // If we reached this branch, we can only create an origin if we have a
 173   // nsIStandardURL.  So, we query to a nsIStandardURL, and fail if we aren't
 174   // an instance of an nsIStandardURL nsIStandardURLs have the good property
 175   // of escaping the '^' character in their specs, which means that we can be
 176   // sure that the caret character (which is reserved for delimiting the end
 177   // of the spec, and the beginning of the origin attributes) is not present
 178   // in the origin string
 179   nsCOMPtr<nsIStandardURL> standardURL = do_QueryInterface(origin);
 180   if (!standardURL) {
 181     return NS_ERROR_FAILURE;
 182   }
 183
 184   // See whether we have a useful hostPort. If we do, use that.
 185   nsAutoCString hostPort;
 186   if (!origin->SchemeIs("chrome")) {
 187     rv = origin->GetAsciiHostPort(hostPort);
 188     NS_ENSURE_SUCCESS(rv, rv);
 189   }
 190   if (!hostPort.IsEmpty()) {
 191     rv = origin->GetScheme(aOriginNoSuffix);
 192     NS_ENSURE_SUCCESS(rv, rv);
 193     aOriginNoSuffix.AppendLiteral("://");
 194     aOriginNoSuffix.Append(hostPort);
 195     return NS_OK;
 196   }
 197
 198   rv = aURI->GetAsciiSpec(aOriginNoSuffix);
 199   NS_ENSURE_SUCCESS(rv, rv);
 200
 201   // The origin, when taken from the spec, should not contain the ref part of
 202   // the URL.
 203
 204   int32_t pos = aOriginNoSuffix.FindChar('?');
 205   int32_t hashPos = aOriginNoSuffix.FindChar('#');
 206
 207   if (hashPos != kNotFound && (pos == kNotFound || hashPos < pos)) {
 208     pos = hashPos;
 209   }
 210
 211   if (pos != kNotFound) {
 212     aOriginNoSuffix.Truncate(pos);
 213   }
 214
 215   return NS_OK;
 216 }
 217
 218 bool ContentPrincipal::SubsumesInternal(
 219     nsIPrincipal* aOther,
 220     BasePrincipal::DocumentDomainConsideration aConsideration) {
 221   MOZ_ASSERT(aOther);
 222
 223   // For ContentPrincipal, Subsumes is equivalent to Equals.
 224   if (aOther == this) {
 225     return true;
 226   }
 227
 228   // If either the subject or the object has changed its principal by
 229   // explicitly setting document.domain then the other must also have
 230   // done so in order to be considered the same origin. This prevents
 231   // DNS spoofing based on document.domain (154930)
 232   nsresult rv;
 233   if (aConsideration == ConsiderDocumentDomain) {
 234     // Get .domain on each principal.
 235     nsCOMPtr<nsIURI> thisDomain, otherDomain;
 236     GetDomain(getter_AddRefs(thisDomain));
 237     aOther->GetDomain(getter_AddRefs(otherDomain));
 238
 239     // If either has .domain set, we have equality i.f.f. the domains match.
 240     // Otherwise, we fall through to the non-document-domain-considering case.
 241     if (thisDomain || otherDomain) {
 242       bool isMatch =
 243           nsScriptSecurityManager::SecurityCompareURIs(thisDomain, otherDomain);
 244 #ifdef DEBUG
 245       if (isMatch) {
 246         nsAutoCString thisSiteOrigin, otherSiteOrigin;
 247         MOZ_ALWAYS_SUCCEEDS(GetSiteOrigin(thisSiteOrigin));
 248         MOZ_ALWAYS_SUCCEEDS(aOther->GetSiteOrigin(otherSiteOrigin));
 249         MOZ_ASSERT(
 250             thisSiteOrigin == otherSiteOrigin,
 251             "SubsumesConsideringDomain passed with mismatched siteOrigin!");
 252       }
 253 #endif
 254       return isMatch;
 255     }
 256   }
 257
 258   // Compare uris.
 259   bool isSameOrigin = false;
 260   rv = aOther->IsSameOrigin(mURI, false, &isSameOrigin);
 261   NS_ENSURE_SUCCESS(rv, false);
 262   return isSameOrigin;
 263 }
 264
 265 NS_IMETHODIMP
 266 ContentPrincipal::GetURI(nsIURI** aURI) {
 267   *aURI = do_AddRef(mURI).take();
 268   return NS_OK;
 269 }
 270
 271 bool ContentPrincipal::MayLoadInternal(nsIURI* aURI) {
 272   MOZ_ASSERT(aURI);
 273
 274 #if defined(MOZ_THUNDERBIRD) || defined(MOZ_SUITE)
 275   nsCOMPtr<nsIURIWithSpecialOrigin> uriWithSpecialOrigin =
 276       do_QueryInterface(aURI);
 277   if (uriWithSpecialOrigin) {
 278     nsCOMPtr<nsIURI> origin;
 279     nsresult rv = uriWithSpecialOrigin->GetOrigin(getter_AddRefs(origin));
 280     if (NS_WARN_IF(NS_FAILED(rv))) {
 281       return false;
 282     }
 283     MOZ_ASSERT(origin);
 284     OriginAttributes attrs;
 285     RefPtr<BasePrincipal> principal =
 286         BasePrincipal::CreateContentPrincipal(origin, attrs);
 287     return nsIPrincipal::Subsumes(principal);
 288   }
 289 #endif
 290
 291   nsCOMPtr<nsIPrincipal> blobPrincipal;
 292   if (dom::BlobURLProtocolHandler::GetBlobURLPrincipal(
 293           aURI, getter_AddRefs(blobPrincipal))) {
 294     MOZ_ASSERT(blobPrincipal);
 295     return nsIPrincipal::Subsumes(blobPrincipal);
 296   }
 297
 298   // If this principal is associated with an addon, check whether that addon
 299   // has been given permission to load from this domain.
 300   if (AddonAllowsLoad(aURI)) {
 301     return true;
 302   }
 303
 304   if (nsScriptSecurityManager::SecurityCompareURIs(mURI, aURI)) {
 305     return true;
 306   }
 307
 308   // If strict file origin policy is in effect, local files will always fail
 309   // SecurityCompareURIs unless they are identical. Explicitly check file origin
 310   // policy, in that case.
 311   if (nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
 312       NS_URIIsLocalFile(aURI) && NS_RelaxStrictFileOriginPolicy(aURI, mURI)) {
 313     return true;
 314   }
 315
 316   return false;
 317 }
 318
 319 uint32_t ContentPrincipal::GetHashValue() {
 320   MOZ_ASSERT(mURI, "Need a principal URI");
 321
 322   nsCOMPtr<nsIURI> uri;
 323   GetDomain(getter_AddRefs(uri));
 324   if (!uri) {
 325     GetURI(getter_AddRefs(uri));
 326   };
 327   return NS_SecurityHashURI(uri);
 328 }
 329
 330 NS_IMETHODIMP
 331 ContentPrincipal::GetDomain(nsIURI** aDomain) {
 332   if (!mDomain) {
 333     *aDomain = nullptr;
 334     return NS_OK;
 335   }
 336
 337   NS_ADDREF(*aDomain = mDomain);
 338   return NS_OK;
 339 }
 340
 341 NS_IMETHODIMP
 342 ContentPrincipal::SetDomain(nsIURI* aDomain) {
 343   MOZ_ASSERT(aDomain);
 344
 345   mDomain = aDomain;
 346   SetHasExplicitDomain();
 347
 348   // Set the changed-document-domain flag on compartments containing realms
 349   // using this principal.
 350   auto cb = [](JSContext*, void*, JS::Realm* aRealm,
 351                const JS::AutoRequireNoGC& nogc) {
 352     JS::Compartment* comp = JS::GetCompartmentForRealm(aRealm);
 353     xpc::SetCompartmentChangedDocumentDomain(comp);
 354   };
 355   JSPrincipals* principals =
 356       nsJSPrincipals::get(static_cast<nsIPrincipal*>(this));
 357
 358   dom::AutoJSAPI jsapi;
 359   jsapi.Init();
 360   JS::IterateRealmsWithPrincipals(jsapi.cx(), principals, nullptr, cb);
 361
 362   return NS_OK;
 363 }
 364
 365 static nsresult GetSpecialBaseDomain(const nsCOMPtr<nsIURI>& aURI,
 366                                      bool* aHandled, nsACString& aBaseDomain) {
 367   *aHandled = false;
 368
 369   // Special handling for a file URI.
 370   if (NS_URIIsLocalFile(aURI)) {
 371     // If strict file origin policy is not in effect, all local files are
 372     // considered to be same-origin, so return a known dummy domain here.
 373     if (!nsScriptSecurityManager::GetStrictFileOriginPolicy()) {
 374       *aHandled = true;
 375       aBaseDomain.AssignLiteral("UNIVERSAL_FILE_URI_ORIGIN");
 376       return NS_OK;
 377     }
 378
 379     // Otherwise, we return the file path.
 380     nsCOMPtr<nsIURL> url = do_QueryInterface(aURI);
 381
 382     if (url) {
 383       *aHandled = true;
 384       return url->GetFilePath(aBaseDomain);
 385     }
 386   }
 387
 388   bool hasNoRelativeFlag;
 389   nsresult rv = NS_URIChainHasFlags(aURI, nsIProtocolHandler::URI_NORELATIVE,
 390                                     &hasNoRelativeFlag);
 391   if (NS_WARN_IF(NS_FAILED(rv))) {
 392     return rv;
 393   }
 394
 395   // In case of FTP we want to get base domain via TLD service even if FTP
 396   // protocol handler is disabled and the scheme is handled by external protocol
 397   // handler which returns URI_NORELATIVE flag.
 398   if (hasNoRelativeFlag && !aURI->SchemeIs("ftp")) {
 399     *aHandled = true;
 400     return aURI->GetSpec(aBaseDomain);
 401   }
 402
 403   if (aURI->SchemeIs("indexeddb")) {
 404     *aHandled = true;
 405     return aURI->GetSpec(aBaseDomain);
 406   }
 407
 408   return NS_OK;
 409 }
 410
 411 NS_IMETHODIMP
 412 ContentPrincipal::GetBaseDomain(nsACString& aBaseDomain) {
 413   // Handle some special URIs first.
 414   bool handled;
 415   nsresult rv = GetSpecialBaseDomain(mURI, &handled, aBaseDomain);
 416   NS_ENSURE_SUCCESS(rv, rv);
 417
 418   if (handled) {
 419     return NS_OK;
 420   }
 421
 422   // For everything else, we ask the TLD service via the ThirdPartyUtil.
 423   nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
 424       do_GetService(THIRDPARTYUTIL_CONTRACTID);
 425   if (!thirdPartyUtil) {
 426     return NS_ERROR_FAILURE;
 427   }
 428
 429   return thirdPartyUtil->GetBaseDomain(mURI, aBaseDomain);
 430 }
 431
 432 NS_IMETHODIMP
 433 ContentPrincipal::GetSiteOriginNoSuffix(nsACString& aSiteOrigin) {
 434   nsresult rv = GetOriginNoSuffix(aSiteOrigin);
 435   NS_ENSURE_SUCCESS(rv, rv);
 436
 437   // It is possible for two principals with the same origin to have different
 438   // mURI values. In order to ensure that two principals with matching origins
 439   // also have matching siteOrigins, we derive the siteOrigin entirely from the
 440   // origin string and do not rely on mURI at all here.
 441   nsCOMPtr<nsIURI> origin;
 442   rv = NS_NewURI(getter_AddRefs(origin), aSiteOrigin);
 443   if (NS_FAILED(rv)) {
 444     // We got an error parsing the origin as a URI? siteOrigin == origin
 445     // aSiteOrigin was already filled with `OriginNoSuffix`
 446     return rv;
 447   }
 448
 449   // Handle some special URIs first.
 450   nsAutoCString baseDomain;
 451   bool handled;
 452   rv = GetSpecialBaseDomain(origin, &handled, baseDomain);
 453   NS_ENSURE_SUCCESS(rv, rv);
 454
 455   if (handled) {
 456     // This is a special URI ("file:", "about:", "view-source:", etc). Just
 457     // return the origin.
 458     return NS_OK;
 459   }
 460
 461   // For everything else, we ask the TLD service. Note that, unlike in
 462   // GetBaseDomain, we don't use ThirdPartyUtil.getBaseDomain because if the
 463   // host is an IP address that returns the raw address and we can't use it with
 464   // SetHost below because SetHost expects '[' and ']' around IPv6 addresses.
 465   // See bug 1491728.
 466   nsCOMPtr<nsIEffectiveTLDService> tldService =
 467       do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
 468   if (!tldService) {
 469     return NS_ERROR_FAILURE;
 470   }
 471
 472   bool gotBaseDomain = false;
 473   rv = tldService->GetBaseDomain(origin, 0, baseDomain);
 474   if (NS_SUCCEEDED(rv)) {
 475     gotBaseDomain = true;
 476   } else {
 477     // If this is an IP address or something like "localhost", we just continue
 478     // with gotBaseDomain = false.
 479     if (rv != NS_ERROR_HOST_IS_IP_ADDRESS &&
 480         rv != NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
 481       return rv;
 482     }
 483   }
 484
 485   // NOTE: Calling `SetHostPort` with a portless domain is insufficient to clear
 486   // the port, so an extra `SetPort` call has to be made.
 487   nsCOMPtr<nsIURI> siteUri;
 488   NS_MutateURI mutator(origin);
 489   mutator.SetUserPass(""_ns).SetPort(-1);
 490   if (gotBaseDomain) {
 491     mutator.SetHost(baseDomain);
 492   }
 493   rv = mutator.Finalize(siteUri);
 494   MOZ_ASSERT(NS_SUCCEEDED(rv), "failed to create siteUri");
 495   NS_ENSURE_SUCCESS(rv, rv);
 496
 497   aSiteOrigin.Truncate();
 498   rv = GenerateOriginNoSuffixFromURI(siteUri, aSiteOrigin);
 499   MOZ_ASSERT(NS_SUCCEEDED(rv), "failed to create siteOriginNoSuffix");
 500   return rv;
 501 }
 502
 503 nsresult ContentPrincipal::GetSiteIdentifier(SiteIdentifier& aSite) {
 504   nsCString siteOrigin;
 505   nsresult rv = GetSiteOrigin(siteOrigin);
 506   NS_ENSURE_SUCCESS(rv, rv);
 507
 508   RefPtr<BasePrincipal> principal = CreateContentPrincipal(siteOrigin);
 509   if (!principal) {
 510     NS_WARNING("could not instantiate content principal");
 511     return NS_ERROR_FAILURE;
 512   }
 513
 514   aSite.Init(principal);
 515   return NS_OK;
 516 }
 517
 518 WebExtensionPolicy* ContentPrincipal::AddonPolicy() {
 519   if (!mAddon.isSome()) {
 520     NS_ENSURE_TRUE(mURI, nullptr);
 521
 522     if (mURI->SchemeIs("moz-extension")) {
 523       mAddon.emplace(EPS().GetByURL(mURI.get()));
 524     } else {
 525       mAddon.emplace(nullptr);
 526     }
 527   }
 528
 529   return mAddon.value();
 530 }
 531
 532 NS_IMETHODIMP
 533 ContentPrincipal::GetAddonId(nsAString& aAddonId) {
 534   auto* policy = AddonPolicy();
 535   if (policy) {
 536     policy->GetId(aAddonId);
 537   } else {
 538     aAddonId.Truncate();
 539   }
 540   return NS_OK;
 541 }
 542
 543 NS_IMETHODIMP
 544 ContentPrincipal::Deserializer::Read(nsIObjectInputStream* aStream) {
 545   MOZ_ASSERT(!mPrincipal);
 546
 547   nsCOMPtr<nsISupports> supports;
 548   nsCOMPtr<nsIURI> principalURI;
 549   nsresult rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 550   if (NS_FAILED(rv)) {
 551     return rv;
 552   }
 553
 554   principalURI = do_QueryInterface(supports);
 555   // Enforce re-parsing about: URIs so that if they change, we continue to use
 556   // their new principals correctly.
 557   if (principalURI->SchemeIs("about")) {
 558     nsAutoCString spec;
 559     principalURI->GetSpec(spec);
 560     NS_ENSURE_SUCCESS(NS_NewURI(getter_AddRefs(principalURI), spec),
 561                       NS_ERROR_FAILURE);
 562   }
 563
 564   nsCOMPtr<nsIURI> domain;
 565   rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 566   if (NS_FAILED(rv)) {
 567     return rv;
 568   }
 569
 570   domain = do_QueryInterface(supports);
 571
 572   nsAutoCString suffix;
 573   rv = aStream->ReadCString(suffix);
 574   NS_ENSURE_SUCCESS(rv, rv);
 575
 576   OriginAttributes attrs;
 577   bool ok = attrs.PopulateFromSuffix(suffix);
 578   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 579
 580   // Since Bug 965637 we do not serialize the CSP within the
 581   // Principal anymore. Nevertheless there might still be
 582   // serialized Principals that do have a serialized CSP.
 583   // For now, we just read the CSP here but do not actually
 584   // consume it. Please note that we deliberately ignore
 585   // the return value to avoid CSP deserialization problems.
 586   // After Bug 1508939 we will have a new serialization for
 587   // Principals which allows us to update the code here.
 588   // Additionally, the format for serialized CSPs changed
 589   // within Bug 965637 which also can cause failures within
 590   // the CSP deserialization code.
 591   Unused << NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 592
 593   nsAutoCString originNoSuffix;
 594   rv = GenerateOriginNoSuffixFromURI(principalURI, originNoSuffix);
 595   NS_ENSURE_SUCCESS(rv, rv);
 596
 597   RefPtr<ContentPrincipal> principal =
 598       new ContentPrincipal(principalURI, attrs, originNoSuffix);
 599
 600   // Note: we don't call SetDomain here because we don't need the wrapper
 601   // recomputation code there (we just created this principal).
 602   if (domain) {
 603     principal->mDomain = domain;
 604     principal->SetHasExplicitDomain();
 605   }
 606
 607   mPrincipal = principal.forget();
 608   return NS_OK;
 609 }
 610
 611 nsresult ContentPrincipal::PopulateJSONObject(Json::Value& aObject) {
 612   nsAutoCString principalURI;
 613   nsresult rv = mURI->GetSpec(principalURI);
 614   NS_ENSURE_SUCCESS(rv, rv);
 615
 616   // We turn each int enum field into a JSON string key of the object
 617   // aObject is the inner JSON object that has stringified enum keys
 618   // An example aObject might be:
 619   //
 620   // eURI                   eSuffix
 621   //    |                           |
 622   //  {"0": "https://mozilla.com", "2": "^privateBrowsingId=1"}
 623   //    |                |          |         |
 624   //    -----------------------------         |
 625   //         |           |                    |
 626   //        Key          ----------------------
 627   //                                |
 628   //                              Value
 629   aObject[std::to_string(eURI)] = principalURI.get();
 630
 631   if (mDomain) {
 632     nsAutoCString domainStr;
 633     rv = mDomain->GetSpec(domainStr);
 634     NS_ENSURE_SUCCESS(rv, rv);
 635     aObject[std::to_string(eDomain)] = domainStr.get();
 636   }
 637
 638   nsAutoCString suffix;
 639   OriginAttributesRef().CreateSuffix(suffix);
 640   if (suffix.Length() > 0) {
 641     aObject[std::to_string(eSuffix)] = suffix.get();
 642   }
 643
 644   return NS_OK;
 645 }
 646
 647 already_AddRefed<BasePrincipal> ContentPrincipal::FromProperties(
 648     nsTArray<ContentPrincipal::KeyVal>& aFields) {
 649   MOZ_ASSERT(aFields.Length() == eMax + 1, "Must have all the keys");
 650   nsresult rv;
 651   nsCOMPtr<nsIURI> principalURI;
 652   nsCOMPtr<nsIURI> domain;
 653   nsCOMPtr<nsIContentSecurityPolicy> csp;
 654   OriginAttributes attrs;
 655
 656   // The odd structure here is to make the code to not compile
 657   // if all the switch enum cases haven't been codified
 658   for (const auto& field : aFields) {
 659     switch (field.key) {
 660       case ContentPrincipal::eURI:
 661         if (!field.valueWasSerialized) {
 662           MOZ_ASSERT(
 663               false,
 664               "Content principals require a principal URI in serialized JSON");
 665           return nullptr;
 666         }
 667         rv = NS_NewURI(getter_AddRefs(principalURI), field.value.get());
 668         NS_ENSURE_SUCCESS(rv, nullptr);
 669
 670         {
 671           // Enforce re-parsing about: URIs so that if they change, we
 672           // continue to use their new principals correctly.
 673           if (principalURI->SchemeIs("about")) {
 674             nsAutoCString spec;
 675             principalURI->GetSpec(spec);
 676             if (NS_FAILED(NS_NewURI(getter_AddRefs(principalURI), spec))) {
 677               return nullptr;
 678             }
 679           }
 680         }
 681         break;
 682       case ContentPrincipal::eDomain:
 683         if (field.valueWasSerialized) {
 684           rv = NS_NewURI(getter_AddRefs(domain), field.value.get());
 685           NS_ENSURE_SUCCESS(rv, nullptr);
 686         }
 687         break;
 688       case ContentPrincipal::eSuffix:
 689         if (field.valueWasSerialized) {
 690           bool ok = attrs.PopulateFromSuffix(field.value);
 691           if (!ok) {
 692             return nullptr;
 693           }
 694         }
 695         break;
 696     }
 697   }
 698   nsAutoCString originNoSuffix;
 699   rv = ContentPrincipal::GenerateOriginNoSuffixFromURI(principalURI,
 700                                                        originNoSuffix);
 701   if (NS_FAILED(rv)) {
 702     return nullptr;
 703   }
 704
 705   RefPtr<ContentPrincipal> principal =
 706       new ContentPrincipal(principalURI, attrs, originNoSuffix);
 707
 708   principal->mDomain = domain;
 709   if (principal->mDomain) {
 710     principal->SetHasExplicitDomain();
 711   }
 712
 713   return principal.forget();
 714 }