Bug 1245184 - CookieManager should remove cookies only if they match the userContextId, r=sicking

browser/base/content/sanitize.js

@@ -241,7 +241,8 @@ Sanitizer.prototype = {
 
               if (cookie.creationTime > range[0]) {
                 // This cookie was created after our cutoff, clear it
-                cookieMgr.remove(cookie.host, cookie.name, cookie.path, false);
+                cookieMgr.remove(cookie.host, cookie.name, cookie.path,
+                                 cookie.originAttributes, false);
 
                 if (++yieldCounter % YIELD_PERIOD == 0) {
                   yield new Promise(resolve => setTimeout(resolve, 0)); // Don't block the main thread too long

browser/components/preferences/cookies.js

@@ -71,7 +71,9 @@ var gCookiesWindow = {
   _cookieEquals: function (aCookieA, aCookieB, aStrippedHost) {
     return aCookieA.rawHost == aStrippedHost &&
            aCookieA.name == aCookieB.name &&
-           aCookieA.path == aCookieB.path;
+           aCookieA.path == aCookieB.path &&
+           ChromeUtils.isOriginAttributesEqual(aCookieA.originAttributes,
+                                               aCookieB.originAttributes);
   },
 
   observe: function (aCookie, aTopic, aData) {
@@ -276,17 +278,21 @@ var gCookiesWindow = {
       var item = this._getItemAtIndex(aIndex);
       if (!item) return;
       this._invalidateCache(aIndex - 1);
-      if (item.container)
+      if (item.container) {
         gCookiesWindow._hosts[item.rawHost] = null;
-      else {
+      } else {
         var parent = this._getItemAtIndex(item.parentIndex);
         for (var i = 0; i < parent.cookies.length; ++i) {
           var cookie = parent.cookies[i];
           if (item.rawHost == cookie.rawHost &&
-              item.name == cookie.name && item.path == cookie.path)
+              item.name == cookie.name &&
+              item.path == cookie.path &&
+              ChromeUtils.isOriginAttributesEqual(item.originAttributes,
+                                                  cookie.originAttributes)) {
             parent.cookies.splice(i, removeCount);
           }
         }
+      }
     },
 
     _invalidateCache: function (aIndex) {
@@ -584,7 +590,8 @@ var gCookiesWindow = {
       blockFutureCookies = psvc.getBoolPref("network.cookie.blockFutureCookies");
     for (var i = 0; i < deleteItems.length; ++i) {
       var item = deleteItems[i];
-      this._cm.remove(item.host, item.name, item.path, blockFutureCookies);
+      this._cm.remove(item.host, item.name, item.path,
+                      item.originAttributes, blockFutureCookies);
     }
   },
 

dom/base/ChromeUtils.cpp

@@ -100,6 +100,17 @@ ChromeUtils::CreateOriginAttributesFromDict(dom::GlobalObject& aGlobal,
   aNewAttrs = aAttrs;
 }
 
+/* static */ bool
+ChromeUtils::IsOriginAttributesEqual(dom::GlobalObject& aGlobal,
+                                     const dom::OriginAttributesDictionary& aA,
+                                     const dom::OriginAttributesDictionary& aB)
+{
+  return aA.mAddonId == aB.mAddonId &&
+         aA.mAppId == aB.mAppId &&
+         aA.mInBrowser == aB.mInBrowser &&
+         aA.mSignedPkg == aB.mSignedPkg &&
+         aA.mUserContextId == aB.mUserContextId;
+}
 
 } // namespace dom
 } // namespace mozilla

dom/base/ChromeUtils.h

@@ -72,6 +72,11 @@ public:
   CreateOriginAttributesFromDict(dom::GlobalObject& aGlobal,
                                  const dom::OriginAttributesDictionary& aAttrs,
                                  dom::OriginAttributesDictionary& aNewAttrs);
+
+  static bool
+  IsOriginAttributesEqual(dom::GlobalObject& aGlobal,
+                          const dom::OriginAttributesDictionary& aA,
+                          const dom::OriginAttributesDictionary& aB);
 };
 
 } // namespace dom

dom/webidl/ChromeUtils.webidl

@@ -63,6 +63,13 @@ interface ChromeUtils : ThreadSafeChromeUtils {
    */
   static OriginAttributesDictionary
   createOriginAttributesFromDict(optional OriginAttributesDictionary originAttrs);
+
+  /**
+   * Returns true if the 2 OriginAttributes are equal.
+   */
+  static boolean
+  isOriginAttributesEqual(optional OriginAttributesDictionary aA,
+                          optional OriginAttributesDictionary aB);
 };
 
 /**

netwerk/cookie/nsCookieService.cpp

@@ -2366,9 +2366,15 @@ NS_IMETHODIMP
 nsCookieService::Remove(const nsACString &aHost,
                         const nsACString &aName,
                         const nsACString &aPath,
-                        bool             aBlocked)
+                        JS::HandleValue  aOriginAttributes,
+                        bool             aBlocked,
+                        JSContext*       aCx)
 {
   NeckoOriginAttributes attrs;
+  if (!attrs.Init(aCx, aOriginAttributes)) {
+    return NS_ERROR_FAILURE;
+  }
+
   return Remove(aHost, attrs, aName, aPath, aBlocked);
 }
 

netwerk/cookie/nsICookieManager.idl

@@ -39,11 +39,14 @@ interface nsICookieManager : nsISupports
    *              dot must be present.
    * @param aName The name specified in the cookie
    * @param aPath The path for which the cookie was set
+   * @param aOriginAttributes The originAttributes of this cookie
    * @param aBlocked Indicates if cookies from this host should be permanently blocked
    *
    */
+  [implicit_jscontext]
   void remove(in AUTF8String   aHost,
               in ACString      aName,
               in AUTF8String   aPath,
+              in jsval         aOriginAttributes,
               in boolean       aBlocked);
 };

netwerk/test/TestCookie.cpp

@@ -675,7 +675,9 @@ main(int32_t argc, char *argv[])
       rv[10] = NS_SUCCEEDED(cookieMgr->Remove(NS_LITERAL_CSTRING("new.domain"), // domain
                                               NS_LITERAL_CSTRING("test3"),      // name
                                               NS_LITERAL_CSTRING("/rabbit"),    // path
-                                              true));                        // is blocked
+                                              JS::NullHandleValue,              // originAttributes
+                                              true,                             // is blocked
+                                              nullptr));                        // JSContext
       rv[11] = NS_SUCCEEDED(cookieMgr2->CookieExists(newDomainCookie, &found)) && !found;
       rv[12] = NS_SUCCEEDED(cookieMgr2->Add(NS_LITERAL_CSTRING("new.domain"),     // domain
                                             NS_LITERAL_CSTRING("/rabbit"),        // path

netwerk/test/moz.build

@@ -52,4 +52,6 @@ RESOURCE_FILES += [
     'urlparse_unx.dat',
 ]
 
+USE_LIBS += ['static:js']
+
 CXXFLAGS += CONFIG['TK_CFLAGS']