caps/BasePrincipal.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef mozilla_BasePrincipal_h
   8 #define mozilla_BasePrincipal_h
   9
  10 #include <stdint.h>
  11 #include "ErrorList.h"
  12 #include "js/TypeDecls.h"
  13 #include "mozilla/AlreadyAddRefed.h"
  14 #include "mozilla/Assertions.h"
  15 #include "mozilla/OriginAttributes.h"
  16 #include "mozilla/RefPtr.h"
  17 #include "nsAtom.h"
  18 #include "nsIPrincipal.h"
  19 #include "nsJSPrincipals.h"
  20 #include "nsStringFwd.h"
  21 #include "nscore.h"
  22
  23 class ExpandedPrincipal;
  24 class mozIDOMWindow;
  25 class nsIChannel;
  26 class nsIReferrerInfo;
  27 class nsISupports;
  28 class nsIURI;
  29 namespace Json {
  30 class Value;
  31 }
  32
  33 namespace mozilla {
  34
  35 namespace dom {
  36 enum class ReferrerPolicy : uint8_t;
  37 }
  38
  39 namespace extensions {
  40 class WebExtensionPolicy;
  41 }
  42
  43 class BasePrincipal;
  44
  45 // Content principals (and content principals embedded within expanded
  46 // principals) stored in SiteIdentifier are guaranteed to contain only the
  47 // eTLD+1 part of the original domain. This is used to determine whether two
  48 // origins are same-site: if it's possible for two origins to access each other
  49 // (maybe after mutating document.domain), then they must have the same site
  50 // identifier.
  51 class SiteIdentifier {
  52  public:
  53   void Init(BasePrincipal* aPrincipal) {
  54     MOZ_ASSERT(aPrincipal);
  55     mPrincipal = aPrincipal;
  56   }
  57
  58   bool IsInitialized() const { return !!mPrincipal; }
  59
  60   bool Equals(const SiteIdentifier& aOther) const;
  61
  62  private:
  63   friend class ::ExpandedPrincipal;
  64
  65   BasePrincipal* GetPrincipal() const {
  66     MOZ_ASSERT(IsInitialized());
  67     return mPrincipal;
  68   }
  69
  70   RefPtr<BasePrincipal> mPrincipal;
  71 };
  72
  73 /*
  74  * Base class from which all nsIPrincipal implementations inherit. Use this for
  75  * default implementations and other commonalities between principal
  76  * implementations.
  77  *
  78  * We should merge nsJSPrincipals into this class at some point.
  79  */
  80 class BasePrincipal : public nsJSPrincipals {
  81  public:
  82   // Warning: this enum impacts Principal serialization into JSON format.
  83   // Only update if you know exactly what you are doing
  84   enum PrincipalKind {
  85     eNullPrincipal = 0,
  86     eContentPrincipal,
  87     eExpandedPrincipal,
  88     eSystemPrincipal,
  89     eKindMax = eSystemPrincipal
  90   };
  91
  92   explicit BasePrincipal(PrincipalKind aKind);
  93
  94   template <typename T>
  95   bool Is() const {
  96     return mKind == T::Kind();
  97   }
  98
  99   template <typename T>
 100   T* As() {
 101     MOZ_ASSERT(Is<T>());
 102     return static_cast<T*>(this);
 103   }
 104
 105   enum DocumentDomainConsideration {
 106     DontConsiderDocumentDomain,
 107     ConsiderDocumentDomain
 108   };
 109   bool Subsumes(nsIPrincipal* aOther,
 110                 DocumentDomainConsideration aConsideration);
 111
 112   NS_IMETHOD GetOrigin(nsACString& aOrigin) final;
 113   NS_IMETHOD GetAsciiOrigin(nsACString& aOrigin) override;
 114   NS_IMETHOD GetOriginNoSuffix(nsACString& aOrigin) final;
 115   NS_IMETHOD Equals(nsIPrincipal* other, bool* _retval) final;
 116   NS_IMETHOD EqualsConsideringDomain(nsIPrincipal* other, bool* _retval) final;
 117   NS_IMETHOD EqualsURI(nsIURI* aOtherURI, bool* _retval) override;
 118   NS_IMETHOD EqualsForPermission(nsIPrincipal* other, bool aExactHost,
 119                                  bool* _retval) final;
 120   NS_IMETHOD Subsumes(nsIPrincipal* other, bool* _retval) final;
 121   NS_IMETHOD SubsumesConsideringDomain(nsIPrincipal* other,
 122                                        bool* _retval) final;
 123   NS_IMETHOD SubsumesConsideringDomainIgnoringFPD(nsIPrincipal* other,
 124                                                   bool* _retval) final;
 125   NS_IMETHOD CheckMayLoad(nsIURI* uri, bool allowIfInheritsPrincipal) final;
 126   NS_IMETHOD CheckMayLoadWithReporting(nsIURI* uri,
 127                                        bool allowIfInheritsPrincipal,
 128                                        uint64_t innerWindowID) final;
 129   NS_IMETHOD GetAddonPolicy(nsISupports** aResult) final;
 130   NS_IMETHOD GetIsNullPrincipal(bool* aResult) override;
 131   NS_IMETHOD GetIsContentPrincipal(bool* aResult) override;
 132   NS_IMETHOD GetIsExpandedPrincipal(bool* aResult) override;
 133   NS_IMETHOD GetIsSystemPrincipal(bool* aResult) override;
 134   NS_IMETHOD GetScheme(nsACString& aScheme) override;
 135   NS_IMETHOD SchemeIs(const char* aScheme, bool* aResult) override;
 136   NS_IMETHOD IsURIInPrefList(const char* aPref, bool* aResult) override;
 137   NS_IMETHOD IsL10nAllowed(nsIURI* aURI, bool* aResult) override;
 138   NS_IMETHOD GetAboutModuleFlags(uint32_t* flags) override;
 139   NS_IMETHOD GetIsAddonOrExpandedAddonPrincipal(bool* aResult) override;
 140   NS_IMETHOD GetOriginAttributes(JSContext* aCx,
 141                                  JS::MutableHandle<JS::Value> aVal) final;
 142   NS_IMETHOD GetAsciiSpec(nsACString& aSpec) override;
 143   NS_IMETHOD GetSpec(nsACString& aSpec) override;
 144   NS_IMETHOD GetExposablePrePath(nsACString& aResult) override;
 145   NS_IMETHOD GetExposableSpec(nsACString& aSpec) override;
 146   NS_IMETHOD GetHostPort(nsACString& aRes) override;
 147   NS_IMETHOD GetHost(nsACString& aRes) override;
 148   NS_IMETHOD GetPrepath(nsACString& aResult) override;
 149   NS_IMETHOD GetFilePath(nsACString& aResult) override;
 150   NS_IMETHOD GetOriginSuffix(nsACString& aOriginSuffix) final;
 151   NS_IMETHOD GetIsIpAddress(bool* aIsIpAddress) override;
 152   NS_IMETHOD GetIsLocalIpAddress(bool* aIsIpAddress) override;
 153   NS_IMETHOD GetIsOnion(bool* aIsOnion) override;
 154   NS_IMETHOD GetIsInIsolatedMozBrowserElement(
 155       bool* aIsInIsolatedMozBrowserElement) final;
 156   NS_IMETHOD GetUserContextId(uint32_t* aUserContextId) final;
 157   NS_IMETHOD GetPrivateBrowsingId(uint32_t* aPrivateBrowsingId) final;
 158   NS_IMETHOD GetSiteOrigin(nsACString& aSiteOrigin) final;
 159   NS_IMETHOD GetSiteOriginNoSuffix(nsACString& aSiteOrigin) override;
 160   NS_IMETHOD IsThirdPartyURI(nsIURI* uri, bool* aRes) override;
 161   NS_IMETHOD IsThirdPartyPrincipal(nsIPrincipal* uri, bool* aRes) override;
 162   NS_IMETHOD IsThirdPartyChannel(nsIChannel* aChannel, bool* aRes) override;
 163   NS_IMETHOD GetIsOriginPotentiallyTrustworthy(bool* aResult) override;
 164   NS_IMETHOD IsSameOrigin(nsIURI* aURI, bool aIsPrivateWin,
 165                           bool* aRes) override;
 166   NS_IMETHOD GetPrefLightCacheKey(nsIURI* aURI, bool aWithCredentials,
 167                                   const OriginAttributes& aOriginAttributes,
 168                                   nsACString& _retval) override;
 169   NS_IMETHOD HasFirstpartyStorageAccess(mozIDOMWindow* aCheckWindow,
 170                                         uint32_t* aRejectedReason,
 171                                         bool* aOutAllowed) override;
 172   NS_IMETHOD GetAsciiHost(nsACString& aAsciiHost) override;
 173   NS_IMETHOD GetLocalStorageQuotaKey(nsACString& aRes) override;
 174   NS_IMETHOD AllowsRelaxStrictFileOriginPolicy(nsIURI* aURI,
 175                                                bool* aRes) override;
 176   NS_IMETHOD CreateReferrerInfo(mozilla::dom::ReferrerPolicy aReferrerPolicy,
 177                                 nsIReferrerInfo** _retval) override;
 178   NS_IMETHOD GetIsScriptAllowedByPolicy(
 179       bool* aIsScriptAllowedByPolicy) override;
 180   NS_IMETHOD GetStorageOriginKey(nsACString& aOriginKey) override;
 181
 182   NS_IMETHOD GetNextSubDomainPrincipal(
 183       nsIPrincipal** aNextSubDomainPrincipal) override;
 184   nsresult ToJSON(nsACString& aJSON);
 185   static already_AddRefed<BasePrincipal> FromJSON(const nsACString& aJSON);
 186   // Method populates a passed Json::Value with serializable fields
 187   // which represent all of the fields to deserialize the principal
 188   virtual nsresult PopulateJSONObject(Json::Value& aObject);
 189
 190   virtual bool AddonHasPermission(const nsAtom* aPerm);
 191
 192   virtual bool IsContentPrincipal() const { return false; };
 193
 194   static BasePrincipal* Cast(nsIPrincipal* aPrin) {
 195     return static_cast<BasePrincipal*>(aPrin);
 196   }
 197
 198   static BasePrincipal& Cast(nsIPrincipal& aPrin) {
 199     return *static_cast<BasePrincipal*>(&aPrin);
 200   }
 201
 202   static const BasePrincipal* Cast(const nsIPrincipal* aPrin) {
 203     return static_cast<const BasePrincipal*>(aPrin);
 204   }
 205
 206   static const BasePrincipal& Cast(const nsIPrincipal& aPrin) {
 207     return *static_cast<const BasePrincipal*>(&aPrin);
 208   }
 209
 210   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 211       const nsACString& aOrigin);
 212
 213   // These following method may not create a content principal in case it's
 214   // not possible to generate a correct origin from the passed URI. If this
 215   // happens, a NullPrincipal is returned.
 216
 217   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 218       nsIURI* aURI, const OriginAttributes& aAttrs);
 219
 220   const OriginAttributes& OriginAttributesRef() final {
 221     return mOriginAttributes;
 222   }
 223   extensions::WebExtensionPolicy* AddonPolicy();
 224   uint32_t UserContextId() const { return mOriginAttributes.mUserContextId; }
 225   uint32_t PrivateBrowsingId() const {
 226     return mOriginAttributes.mPrivateBrowsingId;
 227   }
 228   bool IsInIsolatedMozBrowserElement() const {
 229     return mOriginAttributes.mInIsolatedMozBrowser;
 230   }
 231
 232   PrincipalKind Kind() const { return mKind; }
 233
 234   already_AddRefed<BasePrincipal> CloneForcingOriginAttributes(
 235       const OriginAttributes& aOriginAttributes);
 236
 237   // If this is an add-on content script principal, returns its AddonPolicy.
 238   // Otherwise returns null.
 239   extensions::WebExtensionPolicy* ContentScriptAddonPolicy();
 240
 241   // Helper to check whether this principal is associated with an addon that
 242   // allows unprivileged code to load aURI.  aExplicit == true will prevent
 243   // use of all_urls permission, requiring the domain in its permissions.
 244   bool AddonAllowsLoad(nsIURI* aURI, bool aExplicit = false);
 245
 246   // Call these to avoid the cost of virtual dispatch.
 247   inline bool FastEquals(nsIPrincipal* aOther);
 248   inline bool FastEqualsConsideringDomain(nsIPrincipal* aOther);
 249   inline bool FastSubsumes(nsIPrincipal* aOther);
 250   inline bool FastSubsumesConsideringDomain(nsIPrincipal* aOther);
 251   inline bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther);
 252   inline bool FastSubsumesConsideringDomainIgnoringFPD(nsIPrincipal* aOther);
 253
 254   // Fast way to check whether we have a system principal.
 255   inline bool IsSystemPrincipal() const;
 256
 257   // Returns the principal to inherit when a caller with this principal loads
 258   // the given URI.
 259   //
 260   // For most principal types, this returns the principal itself. For expanded
 261   // principals, it returns the first sub-principal which subsumes the given URI
 262   // (or, if no URI is given, the last allowlist principal).
 263   nsIPrincipal* PrincipalToInherit(nsIURI* aRequestedURI = nullptr);
 264
 265   /* Returns true if this principal's CSP should override a document's CSP for
 266    * loads that it triggers. Currently true for expanded principals which
 267    * subsume the document principal, and add-on content principals regardless
 268    * of whether they subsume the document principal.
 269    */
 270   bool OverridesCSP(nsIPrincipal* aDocumentPrincipal) {
 271     MOZ_ASSERT(aDocumentPrincipal);
 272
 273     // Expanded principals override CSP if and only if they subsume the document
 274     // principal.
 275     if (mKind == eExpandedPrincipal) {
 276       return FastSubsumes(aDocumentPrincipal);
 277     }
 278     // Extension principals always override the CSP non-extension principals.
 279     // This is primarily for the sake of their stylesheets, which are usually
 280     // loaded from channels and cannot have expanded principals.
 281     return (AddonPolicy() &&
 282             !BasePrincipal::Cast(aDocumentPrincipal)->AddonPolicy());
 283   }
 284
 285   uint32_t GetOriginNoSuffixHash() const { return mOriginNoSuffix->hash(); }
 286   uint32_t GetOriginSuffixHash() const { return mOriginSuffix->hash(); }
 287
 288   virtual nsresult GetSiteIdentifier(SiteIdentifier& aSite) = 0;
 289
 290  protected:
 291   virtual ~BasePrincipal();
 292
 293   // Note that this does not check OriginAttributes. Callers that depend on
 294   // those must call Subsumes instead.
 295   virtual bool SubsumesInternal(nsIPrincipal* aOther,
 296                                 DocumentDomainConsideration aConsider) = 0;
 297
 298   // Internal, side-effect-free check to determine whether the concrete
 299   // principal would allow the load ignoring any common behavior implemented in
 300   // BasePrincipal::CheckMayLoad.
 301   virtual bool MayLoadInternal(nsIURI* aURI) = 0;
 302   friend class ::ExpandedPrincipal;
 303
 304   // Helper for implementing CheckMayLoad and CheckMayLoadWithReporting.
 305   nsresult CheckMayLoadHelper(nsIURI* aURI, bool aAllowIfInheritsPrincipal,
 306                               bool aReport, uint64_t aInnerWindowID);
 307
 308   void SetHasExplicitDomain() { mHasExplicitDomain = true; }
 309
 310   // Either of these functions should be called as the last step of the
 311   // initialization of the principal objects.  It's typically called as the
 312   // last step from the Init() method of the child classes.
 313   void FinishInit(const nsACString& aOriginNoSuffix,
 314                   const OriginAttributes& aOriginAttributes);
 315   void FinishInit(BasePrincipal* aOther,
 316                   const OriginAttributes& aOriginAttributes);
 317
 318   // KeyValT holds a principal subtype-specific key value and the associated
 319   // parsed value after JSON parsing.
 320   template <typename SerializedKey>
 321   struct KeyValT {
 322     static_assert(sizeof(SerializedKey) == 1,
 323                   "SerializedKey should be a uint8_t");
 324     SerializedKey key;
 325     bool valueWasSerialized;
 326     nsCString value;
 327   };
 328
 329  private:
 330   static already_AddRefed<BasePrincipal> CreateContentPrincipal(
 331       nsIURI* aURI, const OriginAttributes& aAttrs,
 332       const nsACString& aOriginNoSuffix);
 333
 334   bool FastSubsumesIgnoringFPD(nsIPrincipal* aOther,
 335                                DocumentDomainConsideration aConsideration);
 336
 337   RefPtr<nsAtom> mOriginNoSuffix;
 338   RefPtr<nsAtom> mOriginSuffix;
 339
 340   OriginAttributes mOriginAttributes;
 341   PrincipalKind mKind;
 342   bool mHasExplicitDomain;
 343   bool mInitialized;
 344 };
 345
 346 inline bool BasePrincipal::FastEquals(nsIPrincipal* aOther) {
 347   MOZ_ASSERT(aOther);
 348
 349   auto other = Cast(aOther);
 350   if (Kind() != other->Kind()) {
 351     // Principals of different kinds can't be equal.
 352     return false;
 353   }
 354
 355   // Two principals are considered to be equal if their origins are the same.
 356   // If the two principals are content principals, their origin attributes
 357   // (aka the origin suffix) must also match.
 358   if (Kind() == eSystemPrincipal) {
 359     return this == other;
 360   }
 361
 362   if (Kind() == eContentPrincipal || Kind() == eNullPrincipal) {
 363     return mOriginNoSuffix == other->mOriginNoSuffix &&
 364            mOriginSuffix == other->mOriginSuffix;
 365   }
 366
 367   MOZ_ASSERT(Kind() == eExpandedPrincipal);
 368   return mOriginNoSuffix == other->mOriginNoSuffix;
 369 }
 370
 371 inline bool BasePrincipal::FastEqualsConsideringDomain(nsIPrincipal* aOther) {
 372   MOZ_ASSERT(aOther);
 373
 374   // If neither of the principals have document.domain set, we use the fast path
 375   // in Equals().  Otherwise, we fall back to the slow path below.
 376   auto other = Cast(aOther);
 377   if (!mHasExplicitDomain && !other->mHasExplicitDomain) {
 378     return FastEquals(aOther);
 379   }
 380
 381   return Subsumes(aOther, ConsiderDocumentDomain) &&
 382          other->Subsumes(this, ConsiderDocumentDomain);
 383 }
 384
 385 inline bool BasePrincipal::FastSubsumes(nsIPrincipal* aOther) {
 386   MOZ_ASSERT(aOther);
 387
 388   // If two principals are equal, then they both subsume each other.
 389   if (FastEquals(aOther)) {
 390     return true;
 391   }
 392
 393   // Otherwise, fall back to the slow path.
 394   return Subsumes(aOther, DontConsiderDocumentDomain);
 395 }
 396
 397 inline bool BasePrincipal::FastSubsumesConsideringDomain(nsIPrincipal* aOther) {
 398   MOZ_ASSERT(aOther);
 399
 400   // If neither of the principals have document.domain set, we hand off to
 401   // FastSubsumes() which has fast paths for some special cases. Otherwise, we
 402   // fall back to the slow path below.
 403   if (!mHasExplicitDomain && !Cast(aOther)->mHasExplicitDomain) {
 404     return FastSubsumes(aOther);
 405   }
 406
 407   return Subsumes(aOther, ConsiderDocumentDomain);
 408 }
 409
 410 inline bool BasePrincipal::FastSubsumesIgnoringFPD(nsIPrincipal* aOther) {
 411   return FastSubsumesIgnoringFPD(aOther, DontConsiderDocumentDomain);
 412 }
 413
 414 inline bool BasePrincipal::FastSubsumesConsideringDomainIgnoringFPD(
 415     nsIPrincipal* aOther) {
 416   return FastSubsumesIgnoringFPD(aOther, ConsiderDocumentDomain);
 417 }
 418
 419 inline bool BasePrincipal::IsSystemPrincipal() const {
 420   return Kind() == eSystemPrincipal;
 421 }
 422
 423 }  // namespace mozilla
 424
 425 inline bool nsIPrincipal::IsSystemPrincipal() const {
 426   return mozilla::BasePrincipal::Cast(this)->IsSystemPrincipal();
 427 }
 428
 429 #endif /* mozilla_BasePrincipal_h */