search

RequestPolicy / requestpolicy

RequestPolicy is a Firefox extension that gives you control over cross-site requests. --- Be sure to look at the dev-1.0 branch as that's where all of the interesting work is happening. See also: https://www.requestpolicy.com/1.0.html
https://www.requestpolicy.com/
107 stars 17 forks source link

Cross-domain requests are always allowed when wrapped in a jar URI #408

Closed JordanMilne closed 10 years ago

JordanMilne commented 10 years ago

It's possible to bypass the whitelist entirely by referencing a resource using the jar URI scheme:

Firefox will block the resource from being displayed even if it is valid (due to prior security issues with the jar scheme,) but a cross-domain request is made and it doesn't require JS to execute. This can be verified through the network pane in Firefox's dev tools.

It doesn't get logged because aContentLocation's asciiHost is undefined when the jar URI scheme is used, and it gets treated as an internal request at requestPolicyService.js:1953.

I'm attaching a patch against trunk that fixes it for me. I'm not sure if it has any interactions with extensions, but it should also fix nested use of the view-source scheme.

JordanMilne commented 10 years ago

Whoops, looks like submitting a pull request opens its own issue, closing this one.