Bug 1655190 - Always include third-party cookies in downloads r=Gijs,baku

The internal Download API and the downloads API for extensions trigger
download requests on behalf of users. These should be considered
first-party requests, and therefore not be restricted by sameSite cookie
restrictions or tracking protection.

This patch has two components:

- Ensure that triggeringPrincipal is always the system principal, to
  make sure that `BasePrincipal::IsThirdPartyChannel` returns false
  when called by `CookieCommons::IsSameSiteForeign`.

  The extension API implementation was the only consumer of the
  Download API where triggeringPrincipal wasn't the system principal
  (because loadingPrincipal is a moz-extension:-URI since bug 1579911).

- Set `channel.forceAllowThirdPartyCookie` to true, so that cookies are
  always included in download requests even if the preference
  `network.cookie.cookieBehavior` is 1 (aka BEHAVIOR_REJECT_FOREIGN).

Differential Revision: https://phabricator.services.mozilla.com/D87359

toolkit/components/downloads/DownloadCore.jsm

@@ -2231,6 +2231,9 @@ DownloadCopySaver.prototype = {
             uri: download.source.url,
             contentPolicyType: Ci.nsIContentPolicy.TYPE_SAVEAS_DOWNLOAD,
             loadingPrincipal: download.source.loadingPrincipal,
+            // triggeringPrincipal must be the system principal to prevent the
+            // request from being mistaken as a third-party request.
+            triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(),
             securityFlags:
               Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL,
           });
@@ -2257,6 +2260,9 @@ DownloadCopySaver.prototype = {
         // and also prevents its caching.
         if (channel instanceof Ci.nsIHttpChannelInternal) {
           channel.channelIsForDownload = true;
+
+          // Include cookies even if cookieBehavior is BEHAVIOR_REJECT_FOREIGN.
+          channel.forceAllowThirdPartyCookie = true;
         }
 
         if (

toolkit/components/extensions/test/xpcshell/test_ext_downloads_cookies.js

@@ -163,15 +163,13 @@ add_task(async function download_cookies_without_host_permissions() {
 
   equal(
     await downloadAndGetCookies(extension, "http://example.net/download"),
-    // TODO bug 1655190: should be "c_none=1; c_lax=1; c_strict=1"
-    "c_none=1; c_lax=1",
+    "c_none=1; c_lax=1; c_strict=1",
     "Cookies for downloads.download without host permissions"
   );
 
   equal(
     await downloadAndGetCookies(extension, "http://itisatracker.org/download"),
-    // TODO bug 1655190: should be "c_none=1; c_lax=1; c_strict=1"
-    "",
+    "c_none=1; c_lax=1; c_strict=1",
     "Cookies for downloads.download of itisatracker.org"
   );
 
@@ -180,8 +178,7 @@ add_task(async function download_cookies_without_host_permissions() {
     async () => {
       equal(
         await downloadAndGetCookies(extension, "http://example.net/download"),
-        // TODO bug 1655190: should be "c_none=1; c_lax=1; c_strict=1"
-        "",
+        "c_none=1; c_lax=1; c_strict=1",
         "Cookies for downloads.download with all third-party cookies disabled"
       );
     }