caps/ContentPrincipal.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=2 sw=2 et tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #include "ContentPrincipal.h"
   8
   9 #include "mozIThirdPartyUtil.h"
  10 #include "nsContentUtils.h"
  11 #include "nscore.h"
  12 #include "nsScriptSecurityManager.h"
  13 #include "nsString.h"
  14 #include "nsReadableUtils.h"
  15 #include "pratom.h"
  16 #include "nsIURI.h"
  17 #include "nsIURL.h"
  18 #include "nsIStandardURL.h"
  19 #include "nsIURIWithSpecialOrigin.h"
  20 #include "nsIURIMutator.h"
  21 #include "nsJSPrincipals.h"
  22 #include "nsIEffectiveTLDService.h"
  23 #include "nsIClassInfoImpl.h"
  24 #include "nsIObjectInputStream.h"
  25 #include "nsIObjectOutputStream.h"
  26 #include "nsIProtocolHandler.h"
  27 #include "nsError.h"
  28 #include "nsIContentSecurityPolicy.h"
  29 #include "nsNetCID.h"
  30 #include "js/Wrapper.h"
  31
  32 #include "mozilla/dom/BlobURLProtocolHandler.h"
  33 #include "mozilla/dom/ScriptSettings.h"
  34 #include "mozilla/ClearOnShutdown.h"
  35 #include "mozilla/ExtensionPolicyService.h"
  36 #include "mozilla/Preferences.h"
  37 #include "mozilla/HashFunctions.h"
  38
  39 #include "nsSerializationHelper.h"
  40 #include "json/json.h"
  41
  42 using namespace mozilla;
  43
  44 static inline ExtensionPolicyService& EPS() {
  45   return ExtensionPolicyService::GetSingleton();
  46 }
  47
  48 NS_IMPL_CLASSINFO(ContentPrincipal, nullptr, nsIClassInfo::MAIN_THREAD_ONLY,
  49                   NS_PRINCIPAL_CID)
  50 NS_IMPL_QUERY_INTERFACE_CI(ContentPrincipal, nsIPrincipal, nsISerializable)
  51 NS_IMPL_CI_INTERFACE_GETTER(ContentPrincipal, nsIPrincipal, nsISerializable)
  52
  53 ContentPrincipal::ContentPrincipal() : BasePrincipal(eContentPrincipal) {}
  54
  55 ContentPrincipal::~ContentPrincipal() {}
  56
  57 nsresult ContentPrincipal::Init(nsIURI* aURI,
  58                                 const OriginAttributes& aOriginAttributes,
  59                                 const nsACString& aOriginNoSuffix) {
  60   NS_ENSURE_ARG(aURI);
  61
  62   // Assert that the URI we get here isn't any of the schemes that we know we
  63   // should not get here.  These schemes always either inherit their principal
  64   // or fall back to a null principal.  These are schemes which return
  65   // URI_INHERITS_SECURITY_CONTEXT from their protocol handler's
  66   // GetProtocolFlags function.
  67   bool hasFlag = false;
  68   Unused << hasFlag;  // silence possible compiler warnings.
  69   MOZ_DIAGNOSTIC_ASSERT(
  70       NS_SUCCEEDED(NS_URIChainHasFlags(
  71           aURI, nsIProtocolHandler::URI_INHERITS_SECURITY_CONTEXT, &hasFlag)) &&
  72       !hasFlag);
  73
  74   mURI = aURI;
  75   FinishInit(aOriginNoSuffix, aOriginAttributes);
  76
  77   return NS_OK;
  78 }
  79
  80 nsresult ContentPrincipal::Init(ContentPrincipal* aOther,
  81                                 const OriginAttributes& aOriginAttributes) {
  82   NS_ENSURE_ARG(aOther);
  83
  84   mURI = aOther->mURI;
  85   FinishInit(aOther, aOriginAttributes);
  86
  87   mDomain = aOther->mDomain;
  88   mAddon = aOther->mAddon;
  89   return NS_OK;
  90 }
  91
  92 nsresult ContentPrincipal::GetScriptLocation(nsACString& aStr) {
  93   return mURI->GetSpec(aStr);
  94 }
  95
  96 /* static */
  97 nsresult ContentPrincipal::GenerateOriginNoSuffixFromURI(
  98     nsIURI* aURI, nsACString& aOriginNoSuffix) {
  99   if (!aURI) {
 100     return NS_ERROR_FAILURE;
 101   }
 102
 103   nsCOMPtr<nsIURI> origin = NS_GetInnermostURI(aURI);
 104   if (!origin) {
 105     return NS_ERROR_FAILURE;
 106   }
 107
 108   MOZ_ASSERT(!NS_IsAboutBlank(origin),
 109              "The inner URI for about:blank must be moz-safe-about:blank");
 110
 111   // Handle non-strict file:// uris.
 112   if (!nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
 113       NS_URIIsLocalFile(origin)) {
 114     // If strict file origin policy is not in effect, all local files are
 115     // considered to be same-origin, so return a known dummy origin here.
 116     aOriginNoSuffix.AssignLiteral("file://UNIVERSAL_FILE_URI_ORIGIN");
 117     return NS_OK;
 118   }
 119
 120   nsresult rv;
 121 // NB: This is only compiled for Thunderbird/Suite.
 122 #if IS_ORIGIN_IS_FULL_SPEC_DEFINED
 123   bool fullSpec = false;
 124   rv = NS_URIChainHasFlags(origin, nsIProtocolHandler::ORIGIN_IS_FULL_SPEC,
 125                            &fullSpec);
 126   NS_ENSURE_SUCCESS(rv, rv);
 127   if (fullSpec) {
 128     return origin->GetAsciiSpec(aOriginNoSuffix);
 129   }
 130 #endif
 131
 132   // We want the invariant that prinA.origin == prinB.origin i.f.f.
 133   // prinA.equals(prinB). However, this requires that we impose certain
 134   // constraints on the behavior and origin semantics of principals, and in
 135   // particular, forbid creating origin strings for principals whose equality
 136   // constraints are not expressible as strings (i.e. object equality).
 137   // Moreover, we want to forbid URIs containing the magic "^" we use as a
 138   // separating character for origin attributes.
 139   //
 140   // These constraints can generally be achieved by restricting .origin to
 141   // nsIStandardURL-based URIs, but there are a few other URI schemes that we
 142   // need to handle.
 143   if (origin->SchemeIs("about") ||
 144       (origin->SchemeIs("moz-safe-about") &&
 145        // We generally consider two about:foo origins to be same-origin, but
 146        // about:blank is special since it can be generated from different
 147        // sources. We check for moz-safe-about:blank since origin is an
 148        // innermost URI.
 149        !StringBeginsWith(origin->GetSpecOrDefault(),
 150                          "moz-safe-about:blank"_ns))) {
 151     rv = origin->GetAsciiSpec(aOriginNoSuffix);
 152     NS_ENSURE_SUCCESS(rv, rv);
 153
 154     int32_t pos = aOriginNoSuffix.FindChar('?');
 155     int32_t hashPos = aOriginNoSuffix.FindChar('#');
 156
 157     if (hashPos != kNotFound && (pos == kNotFound || hashPos < pos)) {
 158       pos = hashPos;
 159     }
 160
 161     if (pos != kNotFound) {
 162       aOriginNoSuffix.Truncate(pos);
 163     }
 164
 165     // These URIs could technically contain a '^', but they never should.
 166     if (NS_WARN_IF(aOriginNoSuffix.FindChar('^', 0) != -1)) {
 167       aOriginNoSuffix.Truncate();
 168       return NS_ERROR_FAILURE;
 169     }
 170     return NS_OK;
 171   }
 172
 173   // This URL can be a blobURL. In this case, we should use the 'parent'
 174   // principal instead.
 175   nsCOMPtr<nsIPrincipal> blobPrincipal;
 176   if (dom::BlobURLProtocolHandler::GetBlobURLPrincipal(
 177           origin, getter_AddRefs(blobPrincipal))) {
 178     MOZ_ASSERT(blobPrincipal);
 179     return blobPrincipal->GetOriginNoSuffix(aOriginNoSuffix);
 180   }
 181
 182   // If we reached this branch, we can only create an origin if we have a
 183   // nsIStandardURL.  So, we query to a nsIStandardURL, and fail if we aren't
 184   // an instance of an nsIStandardURL nsIStandardURLs have the good property
 185   // of escaping the '^' character in their specs, which means that we can be
 186   // sure that the caret character (which is reserved for delimiting the end
 187   // of the spec, and the beginning of the origin attributes) is not present
 188   // in the origin string
 189   nsCOMPtr<nsIStandardURL> standardURL = do_QueryInterface(origin);
 190   if (!standardURL) {
 191     return NS_ERROR_FAILURE;
 192   }
 193
 194   // See whether we have a useful hostPort. If we do, use that.
 195   nsAutoCString hostPort;
 196   if (!origin->SchemeIs("chrome")) {
 197     rv = origin->GetAsciiHostPort(hostPort);
 198     NS_ENSURE_SUCCESS(rv, rv);
 199   }
 200   if (!hostPort.IsEmpty()) {
 201     rv = origin->GetScheme(aOriginNoSuffix);
 202     NS_ENSURE_SUCCESS(rv, rv);
 203     aOriginNoSuffix.AppendLiteral("://");
 204     aOriginNoSuffix.Append(hostPort);
 205     return NS_OK;
 206   }
 207
 208   rv = aURI->GetAsciiSpec(aOriginNoSuffix);
 209   NS_ENSURE_SUCCESS(rv, rv);
 210
 211   // The origin, when taken from the spec, should not contain the ref part of
 212   // the URL.
 213
 214   int32_t pos = aOriginNoSuffix.FindChar('?');
 215   int32_t hashPos = aOriginNoSuffix.FindChar('#');
 216
 217   if (hashPos != kNotFound && (pos == kNotFound || hashPos < pos)) {
 218     pos = hashPos;
 219   }
 220
 221   if (pos != kNotFound) {
 222     aOriginNoSuffix.Truncate(pos);
 223   }
 224
 225   return NS_OK;
 226 }
 227
 228 bool ContentPrincipal::SubsumesInternal(
 229     nsIPrincipal* aOther,
 230     BasePrincipal::DocumentDomainConsideration aConsideration) {
 231   MOZ_ASSERT(aOther);
 232
 233   // For ContentPrincipal, Subsumes is equivalent to Equals.
 234   if (aOther == this) {
 235     return true;
 236   }
 237
 238   // If either the subject or the object has changed its principal by
 239   // explicitly setting document.domain then the other must also have
 240   // done so in order to be considered the same origin. This prevents
 241   // DNS spoofing based on document.domain (154930)
 242   nsresult rv;
 243   if (aConsideration == ConsiderDocumentDomain) {
 244     // Get .domain on each principal.
 245     nsCOMPtr<nsIURI> thisDomain, otherDomain;
 246     GetDomain(getter_AddRefs(thisDomain));
 247     aOther->GetDomain(getter_AddRefs(otherDomain));
 248
 249     // If either has .domain set, we have equality i.f.f. the domains match.
 250     // Otherwise, we fall through to the non-document-domain-considering case.
 251     if (thisDomain || otherDomain) {
 252       bool isMatch =
 253           nsScriptSecurityManager::SecurityCompareURIs(thisDomain, otherDomain);
 254 #ifdef DEBUG
 255       if (isMatch) {
 256         nsAutoCString thisSiteOrigin, otherSiteOrigin;
 257         MOZ_ALWAYS_SUCCEEDS(GetSiteOrigin(thisSiteOrigin));
 258         MOZ_ALWAYS_SUCCEEDS(aOther->GetSiteOrigin(otherSiteOrigin));
 259         MOZ_ASSERT(
 260             thisSiteOrigin == otherSiteOrigin,
 261             "SubsumesConsideringDomain passed with mismatched siteOrigin!");
 262       }
 263 #endif
 264       return isMatch;
 265     }
 266   }
 267
 268   // Compare uris.
 269   bool isSameOrigin = false;
 270   rv = aOther->IsSameOrigin(mURI, false, &isSameOrigin);
 271   NS_ENSURE_SUCCESS(rv, false);
 272   return isSameOrigin;
 273 }
 274
 275 NS_IMETHODIMP
 276 ContentPrincipal::GetURI(nsIURI** aURI) {
 277   NS_ADDREF(*aURI = mURI);
 278   return NS_OK;
 279 }
 280
 281 bool ContentPrincipal::MayLoadInternal(nsIURI* aURI) {
 282   MOZ_ASSERT(aURI);
 283
 284 #if defined(MOZ_THUNDERBIRD) || defined(MOZ_SUITE)
 285   nsCOMPtr<nsIURIWithSpecialOrigin> uriWithSpecialOrigin =
 286       do_QueryInterface(aURI);
 287   if (uriWithSpecialOrigin) {
 288     nsCOMPtr<nsIURI> origin;
 289     nsresult rv = uriWithSpecialOrigin->GetOrigin(getter_AddRefs(origin));
 290     if (NS_WARN_IF(NS_FAILED(rv))) {
 291       return false;
 292     }
 293     MOZ_ASSERT(origin);
 294     OriginAttributes attrs;
 295     RefPtr<BasePrincipal> principal =
 296         BasePrincipal::CreateContentPrincipal(origin, attrs);
 297     return nsIPrincipal::Subsumes(principal);
 298   }
 299 #endif
 300
 301   nsCOMPtr<nsIPrincipal> blobPrincipal;
 302   if (dom::BlobURLProtocolHandler::GetBlobURLPrincipal(
 303           aURI, getter_AddRefs(blobPrincipal))) {
 304     MOZ_ASSERT(blobPrincipal);
 305     return nsIPrincipal::Subsumes(blobPrincipal);
 306   }
 307
 308   // If this principal is associated with an addon, check whether that addon
 309   // has been given permission to load from this domain.
 310   if (AddonAllowsLoad(aURI)) {
 311     return true;
 312   }
 313
 314   if (nsScriptSecurityManager::SecurityCompareURIs(mURI, aURI)) {
 315     return true;
 316   }
 317
 318   // If strict file origin policy is in effect, local files will always fail
 319   // SecurityCompareURIs unless they are identical. Explicitly check file origin
 320   // policy, in that case.
 321   if (nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
 322       NS_URIIsLocalFile(aURI) && NS_RelaxStrictFileOriginPolicy(aURI, mURI)) {
 323     return true;
 324   }
 325
 326   return false;
 327 }
 328
 329 uint32_t ContentPrincipal::GetHashValue() {
 330   MOZ_ASSERT(mURI, "Need a principal URI");
 331
 332   nsCOMPtr<nsIURI> uri;
 333   GetDomain(getter_AddRefs(uri));
 334   if (!uri) {
 335     GetURI(getter_AddRefs(uri));
 336   };
 337   return NS_SecurityHashURI(uri);
 338 }
 339
 340 NS_IMETHODIMP
 341 ContentPrincipal::GetDomain(nsIURI** aDomain) {
 342   if (!mDomain) {
 343     *aDomain = nullptr;
 344     return NS_OK;
 345   }
 346
 347   NS_ADDREF(*aDomain = mDomain);
 348   return NS_OK;
 349 }
 350
 351 NS_IMETHODIMP
 352 ContentPrincipal::SetDomain(nsIURI* aDomain) {
 353   MOZ_ASSERT(aDomain);
 354
 355   mDomain = aDomain;
 356   SetHasExplicitDomain();
 357
 358   // Set the changed-document-domain flag on compartments containing realms
 359   // using this principal.
 360   auto cb = [](JSContext*, void*, JS::Realm* aRealm,
 361                const JS::AutoRequireNoGC& nogc) {
 362     JS::Compartment* comp = JS::GetCompartmentForRealm(aRealm);
 363     xpc::SetCompartmentChangedDocumentDomain(comp);
 364   };
 365   JSPrincipals* principals =
 366       nsJSPrincipals::get(static_cast<nsIPrincipal*>(this));
 367
 368   dom::AutoJSAPI jsapi;
 369   jsapi.Init();
 370   JS::IterateRealmsWithPrincipals(jsapi.cx(), principals, nullptr, cb);
 371
 372   return NS_OK;
 373 }
 374
 375 static nsresult GetSpecialBaseDomain(const nsCOMPtr<nsIURI>& aURI,
 376                                      bool* aHandled, nsACString& aBaseDomain) {
 377   *aHandled = false;
 378
 379   // Special handling for a file URI.
 380   if (NS_URIIsLocalFile(aURI)) {
 381     // If strict file origin policy is not in effect, all local files are
 382     // considered to be same-origin, so return a known dummy domain here.
 383     if (!nsScriptSecurityManager::GetStrictFileOriginPolicy()) {
 384       *aHandled = true;
 385       aBaseDomain.AssignLiteral("UNIVERSAL_FILE_URI_ORIGIN");
 386       return NS_OK;
 387     }
 388
 389     // Otherwise, we return the file path.
 390     nsCOMPtr<nsIURL> url = do_QueryInterface(aURI);
 391
 392     if (url) {
 393       *aHandled = true;
 394       return url->GetFilePath(aBaseDomain);
 395     }
 396   }
 397
 398   bool hasNoRelativeFlag;
 399   nsresult rv = NS_URIChainHasFlags(aURI, nsIProtocolHandler::URI_NORELATIVE,
 400                                     &hasNoRelativeFlag);
 401   if (NS_WARN_IF(NS_FAILED(rv))) {
 402     return rv;
 403   }
 404
 405   // In case of FTP we want to get base domain via TLD service even if FTP
 406   // protocol handler is disabled and the scheme is handled by external protocol
 407   // handler which returns URI_NORELATIVE flag.
 408   if (hasNoRelativeFlag && !aURI->SchemeIs("ftp")) {
 409     *aHandled = true;
 410     return aURI->GetSpec(aBaseDomain);
 411   }
 412
 413   if (aURI->SchemeIs("indexeddb")) {
 414     *aHandled = true;
 415     return aURI->GetSpec(aBaseDomain);
 416   }
 417
 418   return NS_OK;
 419 }
 420
 421 NS_IMETHODIMP
 422 ContentPrincipal::GetBaseDomain(nsACString& aBaseDomain) {
 423   // Handle some special URIs first.
 424   bool handled;
 425   nsresult rv = GetSpecialBaseDomain(mURI, &handled, aBaseDomain);
 426   NS_ENSURE_SUCCESS(rv, rv);
 427
 428   if (handled) {
 429     return NS_OK;
 430   }
 431
 432   // For everything else, we ask the TLD service via the ThirdPartyUtil.
 433   nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
 434       do_GetService(THIRDPARTYUTIL_CONTRACTID);
 435   if (!thirdPartyUtil) {
 436     return NS_ERROR_FAILURE;
 437   }
 438
 439   return thirdPartyUtil->GetBaseDomain(mURI, aBaseDomain);
 440 }
 441
 442 NS_IMETHODIMP
 443 ContentPrincipal::GetSiteOriginNoSuffix(nsACString& aSiteOrigin) {
 444   nsresult rv = GetOriginNoSuffix(aSiteOrigin);
 445   NS_ENSURE_SUCCESS(rv, rv);
 446
 447   // It is possible for two principals with the same origin to have different
 448   // mURI values. In order to ensure that two principals with matching origins
 449   // also have matching siteOrigins, we derive the siteOrigin entirely from the
 450   // origin string and do not rely on mURI at all here.
 451   nsCOMPtr<nsIURI> origin;
 452   rv = NS_NewURI(getter_AddRefs(origin), aSiteOrigin);
 453   if (NS_FAILED(rv)) {
 454     // We got an error parsing the origin as a URI? siteOrigin == origin
 455     // aSiteOrigin was already filled with `OriginNoSuffix`
 456     return rv;
 457   }
 458
 459   // Handle some special URIs first.
 460   nsAutoCString baseDomain;
 461   bool handled;
 462   rv = GetSpecialBaseDomain(origin, &handled, baseDomain);
 463   NS_ENSURE_SUCCESS(rv, rv);
 464
 465   if (handled) {
 466     // This is a special URI ("file:", "about:", "view-source:", etc). Just
 467     // return the origin.
 468     return NS_OK;
 469   }
 470
 471   // For everything else, we ask the TLD service. Note that, unlike in
 472   // GetBaseDomain, we don't use ThirdPartyUtil.getBaseDomain because if the
 473   // host is an IP address that returns the raw address and we can't use it with
 474   // SetHost below because SetHost expects '[' and ']' around IPv6 addresses.
 475   // See bug 1491728.
 476   nsCOMPtr<nsIEffectiveTLDService> tldService =
 477       do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
 478   if (!tldService) {
 479     return NS_ERROR_FAILURE;
 480   }
 481
 482   bool gotBaseDomain = false;
 483   rv = tldService->GetBaseDomain(origin, 0, baseDomain);
 484   if (NS_SUCCEEDED(rv)) {
 485     gotBaseDomain = true;
 486   } else {
 487     // If this is an IP address or something like "localhost", we just continue
 488     // with gotBaseDomain = false.
 489     if (rv != NS_ERROR_HOST_IS_IP_ADDRESS &&
 490         rv != NS_ERROR_INSUFFICIENT_DOMAIN_LEVELS) {
 491       return rv;
 492     }
 493   }
 494
 495   // NOTE: Calling `SetHostPort` with a portless domain is insufficient to clear
 496   // the port, so an extra `SetPort` call has to be made.
 497   nsCOMPtr<nsIURI> siteUri;
 498   NS_MutateURI mutator(origin);
 499   mutator.SetUserPass(""_ns).SetPort(-1);
 500   if (gotBaseDomain) {
 501     mutator.SetHost(baseDomain);
 502   }
 503   rv = mutator.Finalize(siteUri);
 504   MOZ_ASSERT(NS_SUCCEEDED(rv), "failed to create siteUri");
 505   NS_ENSURE_SUCCESS(rv, rv);
 506
 507   aSiteOrigin.Truncate();
 508   rv = GenerateOriginNoSuffixFromURI(siteUri, aSiteOrigin);
 509   MOZ_ASSERT(NS_SUCCEEDED(rv), "failed to create siteOriginNoSuffix");
 510   return rv;
 511 }
 512
 513 nsresult ContentPrincipal::GetSiteIdentifier(SiteIdentifier& aSite) {
 514   nsCString siteOrigin;
 515   nsresult rv = GetSiteOrigin(siteOrigin);
 516   NS_ENSURE_SUCCESS(rv, rv);
 517
 518   RefPtr<BasePrincipal> principal = CreateContentPrincipal(siteOrigin);
 519   if (!principal) {
 520     NS_WARNING("could not instantiate content principal");
 521     return NS_ERROR_FAILURE;
 522   }
 523
 524   aSite.Init(principal);
 525   return NS_OK;
 526 }
 527
 528 WebExtensionPolicy* ContentPrincipal::AddonPolicy() {
 529   if (!mAddon.isSome()) {
 530     NS_ENSURE_TRUE(mURI, nullptr);
 531
 532     if (mURI->SchemeIs("moz-extension")) {
 533       mAddon.emplace(EPS().GetByURL(mURI.get()));
 534     } else {
 535       mAddon.emplace(nullptr);
 536     }
 537   }
 538
 539   return mAddon.value();
 540 }
 541
 542 NS_IMETHODIMP
 543 ContentPrincipal::GetAddonId(nsAString& aAddonId) {
 544   auto policy = AddonPolicy();
 545   if (policy) {
 546     policy->GetId(aAddonId);
 547   } else {
 548     aAddonId.Truncate();
 549   }
 550   return NS_OK;
 551 }
 552
 553 NS_IMETHODIMP
 554 ContentPrincipal::Read(nsIObjectInputStream* aStream) {
 555   nsCOMPtr<nsISupports> supports;
 556   nsCOMPtr<nsIURI> principalURI;
 557   nsresult rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 558   if (NS_FAILED(rv)) {
 559     return rv;
 560   }
 561
 562   principalURI = do_QueryInterface(supports);
 563   // Enforce re-parsing about: URIs so that if they change, we continue to use
 564   // their new principals correctly.
 565   if (principalURI->SchemeIs("about")) {
 566     nsAutoCString spec;
 567     principalURI->GetSpec(spec);
 568     NS_ENSURE_SUCCESS(NS_NewURI(getter_AddRefs(principalURI), spec),
 569                       NS_ERROR_FAILURE);
 570   }
 571
 572   nsCOMPtr<nsIURI> domain;
 573   rv = NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 574   if (NS_FAILED(rv)) {
 575     return rv;
 576   }
 577
 578   domain = do_QueryInterface(supports);
 579
 580   nsAutoCString suffix;
 581   rv = aStream->ReadCString(suffix);
 582   NS_ENSURE_SUCCESS(rv, rv);
 583
 584   OriginAttributes attrs;
 585   bool ok = attrs.PopulateFromSuffix(suffix);
 586   NS_ENSURE_TRUE(ok, NS_ERROR_FAILURE);
 587
 588   // Since Bug 965637 we do not serialize the CSP within the
 589   // Principal anymore. Nevertheless there might still be
 590   // serialized Principals that do have a serialized CSP.
 591   // For now, we just read the CSP here but do not actually
 592   // consume it. Please note that we deliberately ignore
 593   // the return value to avoid CSP deserialization problems.
 594   // After Bug 1508939 we will have a new serialization for
 595   // Principals which allows us to update the code here.
 596   // Additionally, the format for serialized CSPs changed
 597   // within Bug 965637 which also can cause failures within
 598   // the CSP deserialization code.
 599   Unused << NS_ReadOptionalObject(aStream, true, getter_AddRefs(supports));
 600
 601   nsAutoCString originNoSuffix;
 602   rv = GenerateOriginNoSuffixFromURI(principalURI, originNoSuffix);
 603   NS_ENSURE_SUCCESS(rv, rv);
 604
 605   rv = Init(principalURI, attrs, originNoSuffix);
 606   NS_ENSURE_SUCCESS(rv, rv);
 607
 608   // Note: we don't call SetDomain here because we don't need the wrapper
 609   // recomputation code there (we just created this principal).
 610   mDomain = domain;
 611   if (mDomain) {
 612     SetHasExplicitDomain();
 613   }
 614
 615   return NS_OK;
 616 }
 617
 618 NS_IMETHODIMP
 619 ContentPrincipal::Write(nsIObjectOutputStream* aStream) {
 620   // Read is used still for legacy principals
 621   MOZ_RELEASE_ASSERT(false, "Old style serialization is removed");
 622   return NS_OK;
 623 }
 624
 625 nsresult ContentPrincipal::PopulateJSONObject(Json::Value& aObject) {
 626   nsAutoCString principalURI;
 627   nsresult rv = mURI->GetSpec(principalURI);
 628   NS_ENSURE_SUCCESS(rv, rv);
 629
 630   // We turn each int enum field into a JSON string key of the object
 631   // aObject is the inner JSON object that has stringified enum keys
 632   // An example aObject might be:
 633   //
 634   // eURI                   eSuffix
 635   //    |                           |
 636   //  {"0": "https://mozilla.com", "2": "^privateBrowsingId=1"}
 637   //    |                |          |         |
 638   //    -----------------------------         |
 639   //         |           |                    |
 640   //        Key          ----------------------
 641   //                                |
 642   //                              Value
 643   aObject[std::to_string(eURI)] = principalURI.get();
 644
 645   if (mDomain) {
 646     nsAutoCString domainStr;
 647     rv = mDomain->GetSpec(domainStr);
 648     NS_ENSURE_SUCCESS(rv, rv);
 649     aObject[std::to_string(eDomain)] = domainStr.get();
 650   }
 651
 652   nsAutoCString suffix;
 653   OriginAttributesRef().CreateSuffix(suffix);
 654   if (suffix.Length() > 0) {
 655     aObject[std::to_string(eSuffix)] = suffix.get();
 656   }
 657
 658   return NS_OK;
 659 }
 660
 661 already_AddRefed<BasePrincipal> ContentPrincipal::FromProperties(
 662     nsTArray<ContentPrincipal::KeyVal>& aFields) {
 663   MOZ_ASSERT(aFields.Length() == eMax + 1, "Must have all the keys");
 664   nsresult rv;
 665   nsCOMPtr<nsIURI> principalURI;
 666   nsCOMPtr<nsIURI> domain;
 667   nsCOMPtr<nsIContentSecurityPolicy> csp;
 668   OriginAttributes attrs;
 669
 670   // The odd structure here is to make the code to not compile
 671   // if all the switch enum cases haven't been codified
 672   for (const auto& field : aFields) {
 673     switch (field.key) {
 674       case ContentPrincipal::eURI:
 675         if (!field.valueWasSerialized) {
 676           MOZ_ASSERT(
 677               false,
 678               "Content principals require a principal URI in serialized JSON");
 679           return nullptr;
 680         }
 681         rv = NS_NewURI(getter_AddRefs(principalURI), field.value.get());
 682         NS_ENSURE_SUCCESS(rv, nullptr);
 683
 684         {
 685           // Enforce re-parsing about: URIs so that if they change, we
 686           // continue to use their new principals correctly.
 687           if (principalURI->SchemeIs("about")) {
 688             nsAutoCString spec;
 689             principalURI->GetSpec(spec);
 690             if (NS_FAILED(NS_NewURI(getter_AddRefs(principalURI), spec))) {
 691               return nullptr;
 692             }
 693           }
 694         }
 695         break;
 696       case ContentPrincipal::eDomain:
 697         if (field.valueWasSerialized) {
 698           rv = NS_NewURI(getter_AddRefs(domain), field.value.get());
 699           NS_ENSURE_SUCCESS(rv, nullptr);
 700         }
 701         break;
 702       case ContentPrincipal::eSuffix:
 703         if (field.valueWasSerialized) {
 704           bool ok = attrs.PopulateFromSuffix(field.value);
 705           if (!ok) {
 706             return nullptr;
 707           }
 708         }
 709         break;
 710     }
 711   }
 712   nsAutoCString originNoSuffix;
 713   rv = ContentPrincipal::GenerateOriginNoSuffixFromURI(principalURI,
 714                                                        originNoSuffix);
 715   if (NS_FAILED(rv)) {
 716     return nullptr;
 717   }
 718
 719   RefPtr<ContentPrincipal> principal = new ContentPrincipal();
 720   rv = principal->Init(principalURI, attrs, originNoSuffix);
 721   if (NS_FAILED(rv)) {
 722     return nullptr;
 723   }
 724
 725   principal->mDomain = domain;
 726   if (principal->mDomain) {
 727     principal->SetHasExplicitDomain();
 728   }
 729
 730   return principal.forget();
 731 }