Medium firefox Logic Error 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionThe WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks.
ComponentToolkit
Bug ClassLogic Error
Tracker1915257
Fix commit882e164a6408 (firefox) +13/-26
CISA KEVNot listed
CreditedAndrew McCreight
Disclosed2025-01-07

Changed Functions

FunctionChangeNotes
_onMessageToChrome
toolkit/actors/WebChannelChild.sys.mjs
modified
if
toolkit/actors/WebChannelChild.sys.mjs
modified
if
toolkit/actors/WebChannelParent.sys.mjs
modified

Files Changed

  • toolkit/actors/WebChannelChild.sys.mjs
  • toolkit/actors/WebChannelParent.sys.mjs
diff --git a/toolkit/actors/WebChannelChild.sys.mjs b/toolkit/actors/WebChannelChild.sys.mjs
index d84659bcde7..b7a37238aa8 100644
--- a/toolkit/actors/WebChannelChild.sys.mjs
+++ b/toolkit/actors/WebChannelChild.sys.mjs
@@ -21,11 +21,6 @@ export class WebChannelChild extends JSWindowActorChild {
   }
 
   _onMessageToChrome(e) {
-    // If target is window then we want the document principal, otherwise fallback to target itself.
-    let principal = e.target.nodePrincipal
-      ? e.target.nodePrincipal
-      : e.target.document.nodePrincipal;
-
     if (e.detail) {
       if (typeof e.detail != "string") {
         console.error("WebChannelMessageToChrome must only send strings");
@@ -39,7 +34,6 @@ export class WebChannelChild extends JSWindowActorChild {
       this.sendAsyncMessage("WebChannelMessageToChrome", {
         contentData: e.detail,
         eventTarget,
-        principal,
       });
     } else {
       console.error("WebChannel message failed. No message detail.");
diff --git a/toolkit/actors/WebChannelParent.sys.mjs b/toolkit/actors/WebChannelParent.sys.mjs
index 98b3ad093a3..c5d78235cc4 100644
--- a/toolkit/actors/WebChannelParent.sys.mjs
+++ b/toolkit/actors/WebChannelParent.sys.mjs
@@ -5,7 +5,9 @@
 
 import { WebChannelBroker } from "resource://gre/modules/WebChannel.sys.mjs";
 
-const ERRNO_MISSING_PRINCIPAL = 1;
+// Note: ERRNO 1 deprecated and unused.
+// We used to err for cases where the child did not send a principal,
+// but now we infer it from the actor.
 const ERRNO_NO_SUCH_CHANNEL = 2;
 
 export class WebChannelParent extends JSWindowActorParent {
@@ -15,7 +17,7 @@ export class WebChannelParent extends JSWindowActorParent {
       browsingContext: this.browsingContext,
       browser: this.browsingContext.top.embedderElement,
       eventTarget: msg.data.eventTarget,
-      principal: msg.data.principal,
+      principal: this.manager.documentPrincipal,
     };
     // data must be a string except for a few legacy origins allowed by browser-content.js.
     if (typeof data == "string") {
@@ -28,28 +30,19 @@ export class WebChannelParent extends JSWindowActorParent {
     }
 
     if (data && data.id) {
-      if (!msg.data.principal) {
+      let validChannelFound = WebChannelBroker.tryToDeliver(
+        data,
+        sendingContext
+      );
+
+      // if no valid origins send an event that there is no such valid channel
+      if (!validChannelFound) {
         this._sendErrorEventToContent(
           data.id,
           sendingContext,
-          ERRNO_MISSING_PRINCIPAL,
-          "Message principal missing"
-        );
-      } else {
-        let validChannelFound = WebChannelBroker.tryToDeliver(
-          data,
-          sendingContext
+          ERRNO_NO_SUCH_CHANNEL,
+          "No Such Channel"
         );
-
-        // if no valid origins send an event that there is no such valid channel
-        if (!validChannelFound) {
-          this._sendErrorEventToContent(
-            data.id,
-            sendingContext,
-            ERRNO_NO_SUCH_CHANNEL,
-            "No Such Channel"
-          );
-        }
       }
     } else {
       console.error("WebChannel channel id missing");
Loading diff…