caps/BasePrincipal.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef mozilla_BasePrincipal_h
   8 #define mozilla_BasePrincipal_h
   9
  10 #include "nsJSPrincipals.h"
  11
  12 #include "mozilla/Attributes.h"
  13 #include "mozilla/OriginAttributes.h"
  14
  15 class nsAtom;
  16 class nsIContentSecurityPolicy;
  17 class nsIObjectOutputStream;
  18 class nsIObjectInputStream;
  19 class nsIURI;
  20
  21 class ExpandedPrincipal;
  22
  23 namespace mozilla {
  24 namespace dom {
  25 class Document;
  26 }
  27 namespace extensions {
  28 class WebExtensionPolicy;
  29 }
  30
  31 class BasePrincipal;
  32
  33 // Codebase principals (and codebase principals embedded within expanded
  34 // principals) stored in SiteIdentifier are guaranteed to contain only the
  35 // eTLD+1 part of the original domain. This is used to determine whether two
  36 // origins are same-site: if it's possible for two origins to access each other
  37 // (maybe after mutating document.domain), then they must have the same site
  38 // identifier.
  39 class SiteIdentifier {
  40  public:
  41   void Init(BasePrincipal* aPrincipal) {
  42     MOZ_ASSERT(aPrincipal);
  43     mPrincipal = aPrincipal;
  44   }
  45
  46   bool IsInitialized() const { return !!mPrincipal; }
  47
  48   bool Equals(const SiteIdentifier& aOther) const;
  49
  50  private:
  51   friend class ::ExpandedPrincipal;
  52
  53   BasePrincipal* GetPrincipal() const {
  54     MOZ_ASSERT(IsInitialized());
  55     return mPrincipal;
  56   }
  57
  58   RefPtr<BasePrincipal> mPrincipal;
  59 };
  60
  61 /*
  62  * Base class from which all nsIPrincipal implementations inherit. Use this for
  63  * default implementations and other commonalities between principal
  64  * implementations.
  65  *
  66  * We should merge nsJSPrincipals into this class at some point.
  67  */
  68 class BasePrincipal : public nsJSPrincipals {
  69  public:
  70   enum PrincipalKind {
  71     eNullPrincipal,
  72     eCodebasePrincipal,
  73     eExpandedPrincipal,
  74     eSystemPrincipal
  75   };
  76
  77   explicit BasePrincipal(PrincipalKind aKind);
  78
  79   template <typename T>
  80   bool Is() const {
  81     return mKind == T::Kind();
  82   }
  83
  84   template <typename T>
  85   T* As() {
  86     MOZ_ASSERT(Is<T>());
  87     return static_cast<T*>(this);
  88   }
  89
  90   enum DocumentDomainConsideration {
  91     DontConsiderDocumentDomain,
  92     ConsiderDocumentDomain
  93   };
  94   bool Subsumes(nsIPrincipal* aOther,
  95                 DocumentDomainConsideration aConsideration);
  96
  97   NS_IMETHOD GetOrigin(nsACString& aOrigin) final;
  98   NS_IMETHOD GetOriginNoSuffix(nsACString& aOrigin) final;
  99   NS_IMETHOD Equals(nsIPrincipal* other, bool* _retval) final;
 100   NS_IMETHOD EqualsConsideringDomain(nsIPrincipal* other, bool* _retval) final;
 101   NS_IMETHOD Subsumes(nsIPrincipal* other, bool* _retval) final;
 102   NS_IMETHOD SubsumesConsideringDomain(nsIPrincipal* other,
 103                                        bool* _retval) final;
 104   NS_IMETHOD SubsumesConsideringDomainIgnoringFPD(nsIPrincipal* other,
 105                                                   bool* _retval) final;
 106   NS_IMETHOD CheckMayLoad(nsIURI* uri, bool report,
 107                           bool allowIfInheritsPrincipal) final;
 108   NS_IMETHOD GetAddonPolicy(nsISupports** aResult) final;
 109   NS_IMETHOD GetCsp(nsIContentSecurityPolicy** aCsp) override;
 110   NS_IMETHOD SetCsp(nsIContentSecurityPolicy* aCsp) override;
 111   NS_IMETHOD EnsureCSP(dom::Document* aDocument,
 112                        nsIContentSecurityPolicy** aCSP) override;
 113   NS_IMETHOD GetPreloadCsp(nsIContentSecurityPolicy** aPreloadCSP) override;
 114   NS_IMETHOD EnsurePreloadCSP(dom::Document* aDocument,
 115                               nsIContentSecurityPolicy** aCSP) override;
 116   NS_IMETHOD GetCspJSON(nsAString& outCSPinJSON) override;
 117   NS_IMETHOD GetIsNullPrincipal(bool* aResult) override;
 118   NS_IMETHOD GetIsCodebasePrincipal(bool* aResult) override;
 119   NS_IMETHOD GetIsExpandedPrincipal(bool* aResult) override;
 120   NS_IMETHOD GetIsSystemPrincipal(bool* aResult) override;
 121   NS_IMETHOD GetIsAddonOrExpandedAddonPrincipal(bool* aResult) override;
 122   NS_IMETHOD GetOriginAttributes(JSContext* aCx,
 123                                  JS::MutableHandle<JS::Value> aVal) final;
 124   NS_IMETHOD GetOriginSuffix(nsACString& aOriginSuffix) final;
 125   NS_IMETHOD GetAppId(uint32_t* aAppId) final;
 126   NS_IMETHOD GetIsInIsolatedMozBrowserElement(
 127       bool* aIsInIsolatedMozBrowserElement) final;
 128   NS_IMETHOD GetUserContextId(uint32_t* aUserContextId) final;
 129   NS_IMETHOD GetPrivateBrowsingId(uint32_t* aPrivateBrowsingId) final;
 130   NS_IMETHOD GetSiteOrigin(nsACString& aOrigin) override;
 131
 132   virtual bool AddonHasPermission(const nsAtom* aPerm);
 133
 134   virtual bool IsCodebasePrincipal() const { return false; };
 135
 136   static BasePrincipal* Cast(nsIPrincipal* aPrin) {
 137     return static_cast<BasePrincipal*>(aPrin);
 138   }
 139
 140   static const BasePrincipal* Cast(const nsIPrincipal* aPrin) {
 141     return static_cast<const BasePrincipal*>(aPrin);
 142   }
 143
 144   static already_AddRefed<BasePrincipal> CreateCodebasePrincipal(
 145       const nsACString& aOrigin);
 146
 147   // These following method may not create a codebase principal in case it's
 148   // not possible to generate a correct origin from the passed URI. If this
 149   // happens, a NullPrincipal is returned.
 150
 151   static already_AddRefed<BasePrincipal> CreateCodebasePrincipal(
 152       nsIURI* aURI, const OriginAttributes& aAttrs);
 153
 154   const OriginAttributes& OriginAttributesRef() final {
 155     return mOriginAttributes;
 156   }
 157   uint32_t AppId() const { return mOriginAttributes.mAppId; }
 158   extensions::WebExtensionPolicy* AddonPolicy();
 159   uint32_t UserContextId() const { return mOriginAttributes.mUserContextId; }
 160   uint32_t PrivateBrowsingId() const {
 161     return mOriginAttributes.mPrivateBrowsingId;
 162   }
 163   bool IsInIsolatedMozBrowserElement() const {
 164     return mOriginAttributes.mInIsolatedMozBrowser;
 165   }
 166
 167   PrincipalKind Kind() const { return mKind; }
 168
 169   already_AddRefed<BasePrincipal>
 170   CloneStrippingUserContextIdAndFirstPartyDomain();
 171
 172   // If this is an add-on content script principal, returns its AddonPolicy.
 173   // Otherwise returns null.
 174   extensions::WebExtensionPolicy* ContentScriptAddonPolicy();
 175
 176   // Helper to check whether this principal is associated with an addon that
 177   // allows unprivileged code to load aURI.  aExplicit == true will prevent
 178   // use of all_urls permission, requiring the domain in its permissions.
 179   bool AddonAllowsLoad(nsIURI* aURI, bool aExplicit = false);
 180
 181   // Call these to avoid the cost of virtual dispatch.
 182   inline bool FastEquals(nsIPrincipal* aOther);
 183   inline bool FastEqualsConsideringDomain(nsIPrincipal* aOther);
 184   inline bool FastSubsumes(nsIPrincipal* aOther);
 185   inline bool FastSubsumesConsideringDomain(nsIPrincipal* aOther);
 186   inline bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther);
 187   inline bool FastSubsumesConsideringDomainIgnoringFPD(nsIPrincipal* aOther);
 188
 189   // Fast way to check whether we have a system principal.
 190   inline bool IsSystemPrincipal() const;
 191
 192   // Returns the principal to inherit when a caller with this principal loads
 193   // the given URI.
 194   //
 195   // For most principal types, this returns the principal itself. For expanded
 196   // principals, it returns the first sub-principal which subsumes the given URI
 197   // (or, if no URI is given, the last allowlist principal).
 198   nsIPrincipal* PrincipalToInherit(nsIURI* aRequestedURI = nullptr);
 199
 200   /**
 201    * Returns true if this principal's CSP should override a document's CSP for
 202    * loads that it triggers. Currently true for system principal, for expanded
 203    * principals which subsume the document principal, and add-on codebase
 204    * principals regardless of whether they subsume the document principal.
 205    */
 206   bool OverridesCSP(nsIPrincipal* aDocumentPrincipal) {
 207     // SystemPrincipal can override the page's CSP by definition.
 208     if (mKind == eSystemPrincipal) {
 209       return true;
 210     }
 211
 212     // Expanded principals override CSP if and only if they subsume the document
 213     // principal.
 214     if (mKind == eExpandedPrincipal) {
 215       return FastSubsumes(aDocumentPrincipal);
 216     }
 217     // Extension principals always override the CSP non-extension principals.
 218     // This is primarily for the sake of their stylesheets, which are usually
 219     // loaded from channels and cannot have expanded principals.
 220     return (AddonPolicy() &&
 221             !BasePrincipal::Cast(aDocumentPrincipal)->AddonPolicy());
 222   }
 223
 224   uint32_t GetOriginNoSuffixHash() const { return mOriginNoSuffix->hash(); }
 225
 226   virtual nsresult GetSiteIdentifier(SiteIdentifier& aSite) = 0;
 227
 228  protected:
 229   virtual ~BasePrincipal();
 230
 231   // Note that this does not check OriginAttributes. Callers that depend on
 232   // those must call Subsumes instead.
 233   virtual bool SubsumesInternal(nsIPrincipal* aOther,
 234                                 DocumentDomainConsideration aConsider) = 0;
 235
 236   // Internal, side-effect-free check to determine whether the concrete
 237   // principal would allow the load ignoring any common behavior implemented in
 238   // BasePrincipal::CheckMayLoad.
 239   virtual bool MayLoadInternal(nsIURI* aURI) = 0;
 240   friend class ::ExpandedPrincipal;
 241
 242   void SetHasExplicitDomain() { mHasExplicitDomain = true; }
 243
 244   // Either of these functions should be called as the last step of the
 245   // initialization of the principal objects.  It's typically called as the
 246   // last step from the Init() method of the child classes.
 247   void FinishInit(const nsACString& aOriginNoSuffix,
 248                   const OriginAttributes& aOriginAttributes);
 249   void FinishInit(BasePrincipal* aOther,
 250                   const OriginAttributes& aOriginAttributes);
 251
 252   nsCOMPtr<nsIContentSecurityPolicy> mCSP;
 253   nsCOMPtr<nsIContentSecurityPolicy> mPreloadCSP;
 254
 255  private:
 256   static already_AddRefed<BasePrincipal> CreateCodebasePrincipal(
 257       nsIURI* aURI, const OriginAttributes& aAttrs,
 258       const nsACString& aOriginNoSuffix);
 259
 260   inline bool FastSubsumesIgnoringFPD(
 261       nsIPrincipal* aOther, DocumentDomainConsideration aConsideration);
 262
 263   RefPtr<nsAtom> mOriginNoSuffix;
 264   RefPtr<nsAtom> mOriginSuffix;
 265
 266   OriginAttributes mOriginAttributes;
 267   PrincipalKind mKind;
 268   bool mHasExplicitDomain;
 269   bool mInitialized;
 270 };
 271
 272 inline bool BasePrincipal::FastEquals(nsIPrincipal* aOther) {
 273   auto other = Cast(aOther);
 274   if (Kind() != other->Kind()) {
 275     // Principals of different kinds can't be equal.
 276     return false;
 277   }
 278
 279   // Two principals are considered to be equal if their origins are the same.
 280   // If the two principals are codebase principals, their origin attributes
 281   // (aka the origin suffix) must also match.
 282   // If the two principals are null principals, they're only equal if they're
 283   // the same object.
 284   if (Kind() == eNullPrincipal || Kind() == eSystemPrincipal) {
 285     return this == other;
 286   }
 287
 288   if (Kind() == eCodebasePrincipal) {
 289     return mOriginNoSuffix == other->mOriginNoSuffix &&
 290            mOriginSuffix == other->mOriginSuffix;
 291   }
 292
 293   MOZ_ASSERT(Kind() == eExpandedPrincipal);
 294   return mOriginNoSuffix == other->mOriginNoSuffix;
 295 }
 296
 297 inline bool BasePrincipal::FastEqualsConsideringDomain(nsIPrincipal* aOther) {
 298   // If neither of the principals have document.domain set, we use the fast path
 299   // in Equals().  Otherwise, we fall back to the slow path below.
 300   auto other = Cast(aOther);
 301   if (!mHasExplicitDomain && !other->mHasExplicitDomain) {
 302     return FastEquals(aOther);
 303   }
 304
 305   return Subsumes(aOther, ConsiderDocumentDomain) &&
 306          other->Subsumes(this, ConsiderDocumentDomain);
 307 }
 308
 309 inline bool BasePrincipal::FastSubsumes(nsIPrincipal* aOther) {
 310   // If two principals are equal, then they both subsume each other.
 311   // We deal with two special cases first:
 312   // Null principals only subsume each other if they are equal, and are only
 313   // equal if they're the same object.
 314   auto other = Cast(aOther);
 315   if (Kind() == eNullPrincipal && other->Kind() == eNullPrincipal) {
 316     return this == other;
 317   }
 318   if (FastEquals(aOther)) {
 319     return true;
 320   }
 321
 322   // Otherwise, fall back to the slow path.
 323   return Subsumes(aOther, DontConsiderDocumentDomain);
 324 }
 325
 326 inline bool BasePrincipal::FastSubsumesConsideringDomain(nsIPrincipal* aOther) {
 327   // If neither of the principals have document.domain set, we hand off to
 328   // FastSubsumes() which has fast paths for some special cases. Otherwise, we
 329   // fall back to the slow path below.
 330   if (!mHasExplicitDomain && !Cast(aOther)->mHasExplicitDomain) {
 331     return FastSubsumes(aOther);
 332   }
 333
 334   return Subsumes(aOther, ConsiderDocumentDomain);
 335 }
 336
 337 inline bool BasePrincipal::FastSubsumesIgnoringFPD(
 338     nsIPrincipal* aOther, DocumentDomainConsideration aConsideration) {
 339   if (Kind() == eCodebasePrincipal &&
 340       !dom::ChromeUtils::IsOriginAttributesEqualIgnoringFPD(
 341           mOriginAttributes, Cast(aOther)->mOriginAttributes)) {
 342     return false;
 343   }
 344
 345   return SubsumesInternal(aOther, aConsideration);
 346 }
 347
 348 inline bool BasePrincipal::FastSubsumesIgnoringFPD(nsIPrincipal* aOther) {
 349   return FastSubsumesIgnoringFPD(aOther, DontConsiderDocumentDomain);
 350 }
 351
 352 inline bool BasePrincipal::FastSubsumesConsideringDomainIgnoringFPD(
 353     nsIPrincipal* aOther) {
 354   return FastSubsumesIgnoringFPD(aOther, ConsiderDocumentDomain);
 355 }
 356
 357 inline bool BasePrincipal::IsSystemPrincipal() const {
 358   return Kind() == eSystemPrincipal;
 359 }
 360
 361 }  // namespace mozilla
 362
 363 inline bool nsIPrincipal::IsSystemPrincipal() const {
 364   return mozilla::BasePrincipal::Cast(this)->IsSystemPrincipal();
 365 }
 366
 367 #endif /* mozilla_BasePrincipal_h */