Bug 791594 - Hide authPromptSpoofing protection behind a pref. r=pbz

Differential Revision: https://phabricator.services.mozilla.com/D164443

browser/actors/PromptParent.jsm

@@ -319,7 +319,16 @@ class PromptParent extends JSWindowActorParent {
         let currentLocationsTabLabel;
 
         let targetTab = win.gBrowser.getTabForBrowser(browser);
-        if (args.isTopLevelCrossDomainAuth) {
+        if (
+          !Services.prefs.getBoolPref(
+            "privacy.authPromptSpoofingProtection",
+            false
+          )
+        ) {
+          args.isTopLevelCrossDomainAuth = false;
+        }
+        // Auth prompt spoofing protection, see bug 791594.
+        if (args.isTopLevelCrossDomainAuth && targetTab) {
           // Set up the url bar with the url of the cross domain resource.
           // onLocationChange will change the url back to the current browsers
           // if we do not hold the state here.

browser/app/profile/firefox.js

@@ -939,6 +939,10 @@ pref("privacy.panicButton.enabled",         true);
 // Time until temporary permissions expire, in ms
 pref("privacy.temporary_permission_expire_time_ms",  3600000);
 
+// Enables protection mechanism against password spoofing for cross domain auh requests
+// See bug 791594
+pref("privacy.authPromptSpoofingProtection",         true);
+
 pref("network.proxy.share_proxy_settings",  false); // use the same proxy settings for all protocols
 
 // simple gestures support

browser/base/content/test/tabPrompts/browser_auth_spoofing_protection.js

@@ -26,10 +26,15 @@ const AUTH_URL = TEST_PATH_AUTH + "auth-route.sjs";
  *         false if we want to test the case when the user cancels the prompt.
  * @param {Boolean} crossDomain - if true we will open a url that redirects us to a cross domain url,
  *        if false, we will open a url that redirects us to a same domain url
+ * @param {Boolean} prefEnabled true will enable "privacy.authPromptSpoofingProtection",
+ *        false will disable the pref
  */
-async function trigger401AndHandle(doConfirmPrompt, crossDomain) {
+async function trigger401AndHandle(doConfirmPrompt, crossDomain, prefEnabled) {
+  await SpecialPowers.pushPrefEnv({
+    set: [["privacy.authPromptSpoofingProtection", prefEnabled]],
+  });
   let url = crossDomain ? CROSS_DOMAIN_URL : SAME_DOMAIN_URL;
-  let dialogShown = waitForDialog(doConfirmPrompt, crossDomain);
+  let dialogShown = waitForDialog(doConfirmPrompt, crossDomain, prefEnabled);
   await BrowserTestUtils.withNewTab(url, async function() {
     await dialogShown;
   });
@@ -41,70 +46,90 @@ async function trigger401AndHandle(doConfirmPrompt, crossDomain) {
   });
 }
 
-async function waitForDialog(doConfirmPrompt, crossDomain) {
+async function waitForDialog(doConfirmPrompt, crossDomain, prefEnabled) {
   await TestUtils.topicObserved("common-dialog-loaded");
   let dialog = gBrowser.getTabDialogBox(gBrowser.selectedBrowser)
     ._tabDialogManager._topDialog;
   let dialogDocument = dialog._frame.contentDocument;
   if (crossDomain) {
-    Assert.equal(
-      dialog._overlay.getAttribute("hideContent"),
-      "true",
-      "Dialog overlay hides the current sites content"
-    );
-    Assert.equal(
-      window.gURLBar.value,
-      AUTH_URL,
-      "Correct location is provided by the prompt"
-    );
-    Assert.equal(
-      window.gBrowser.selectedTab.label,
-      "example.org",
-      "Tab title is manipulated"
-    );
-    // switch to another tab and make sure we dont mess up this new tabs url bar and tab title
-    let tab = await BrowserTestUtils.openNewForegroundTab(
-      gBrowser,
-      "https://example.org:443"
-    );
-    Assert.equal(
-      window.gURLBar.value,
-      "https://example.org",
-      "No location is provided by the prompt, correct location is displayed"
-    );
-    Assert.equal(
-      window.gBrowser.selectedTab.label,
-      "mochitest index /",
-      "Tab title is not manipulated"
-    );
-    // switch back to our tab with the prompt and make sure the url bar state and tab title is still there
-    BrowserTestUtils.removeTab(tab);
-    Assert.equal(
-      window.gURLBar.value,
-      AUTH_URL,
-      "Correct location is provided by the prompt"
-    );
-    Assert.equal(
-      window.gBrowser.selectedTab.label,
-      "example.org",
-      "Tab title is manipulated"
-    );
-    // make sure a value that the user types in has a higher priority than our prompts location
-    gBrowser.selectedBrowser.userTypedValue = "user value";
-    gURLBar.setURI();
-    Assert.equal(
-      window.gURLBar.value,
-      "user value",
-      "User typed value is shown"
-    );
-    // if the user clears the url bar we again fall back to the location of the prompt if we trigger setURI by a tab switch
-    gBrowser.selectedBrowser.userTypedValue = "";
-    gURLBar.setURI(null, true);
-    Assert.equal(
-      window.gURLBar.value,
-      AUTH_URL,
-      "Correct location is provided by the prompt"
-    );
+    if (prefEnabled) {
+      Assert.equal(
+        dialog._overlay.getAttribute("hideContent"),
+        "true",
+        "Dialog overlay hides the current sites content"
+      );
+      Assert.equal(
+        window.gURLBar.value,
+        AUTH_URL,
+        "Correct location is provided by the prompt"
+      );
+      Assert.equal(
+        window.gBrowser.selectedTab.label,
+        "example.org",
+        "Tab title is manipulated"
+      );
+      // switch to another tab and make sure we dont mess up this new tabs url bar and tab title
+      let tab = await BrowserTestUtils.openNewForegroundTab(
+        gBrowser,
+        "https://example.org:443"
+      );
+      Assert.equal(
+        window.gURLBar.value,
+        "https://example.org",
+        "No location is provided by the prompt, correct location is displayed"
+      );
+      Assert.equal(
+        window.gBrowser.selectedTab.label,
+        "mochitest index /",
+        "Tab title is not manipulated"
+      );
+      // switch back to our tab with the prompt and make sure the url bar state and tab title is still there
+      BrowserTestUtils.removeTab(tab);
+      Assert.equal(
+        window.gURLBar.value,
+        AUTH_URL,
+        "Correct location is provided by the prompt"
+      );
+      Assert.equal(
+        window.gBrowser.selectedTab.label,
+        "example.org",
+        "Tab title is manipulated"
+      );
+      // make sure a value that the user types in has a higher priority than our prompts location
+      gBrowser.selectedBrowser.userTypedValue = "user value";
+      gURLBar.setURI();
+      Assert.equal(
+        window.gURLBar.value,
+        "user value",
+        "User typed value is shown"
+      );
+      // if the user clears the url bar we again fall back to the location of the prompt if we trigger setURI by a tab switch
+      gBrowser.selectedBrowser.userTypedValue = "";
+      gURLBar.setURI(null, true);
+      Assert.equal(
+        window.gURLBar.value,
+        AUTH_URL,
+        "Correct location is provided by the prompt"
+      );
+      // Cross domain and pref is not enabled
+    } else {
+      Assert.equal(
+        dialog._overlay.getAttribute("hideContent"),
+        "",
+        "Dialog overlay does not hide the current sites content"
+      );
+      Assert.equal(
+        window.gURLBar.value,
+        CROSS_DOMAIN_URL,
+        "No location is provided by the prompt, correct location is displayed"
+      );
+      Assert.equal(
+        window.gBrowser.selectedTab.label,
+        "example.com",
+        "Tab title is not manipulated"
+      );
+    }
+    // same domain
   } else {
     Assert.equal(
       dialog._overlay.getAttribute("hideContent"),
@@ -152,34 +177,56 @@ async function waitForDialog(doConfirmPrompt, crossDomain) {
   );
 }
 
+add_setup(async function() {
+  await SpecialPowers.pushPrefEnv({
+    set: [["privacy.authPromptSpoofingProtection", true]],
+  });
+});
+
 /**
  * Tests that the 401 auth spoofing mechanisms apply if the 401 is from a different base domain than the current sites,
  * canceling the prompt
  */
-add_task(async function testCrossDomainCancel() {
-  await trigger401AndHandle(false, true);
+add_task(async function testCrossDomainCancelPrefEnabled() {
+  await trigger401AndHandle(false, true, true);
 });
 
 /**
  * Tests that the 401 auth spoofing mechanisms apply if the 401 is from a different base domain than the current sites,
  * accepting the prompt
  */
-add_task(async function testCrossDomainAccept() {
-  await trigger401AndHandle(true, true);
+add_task(async function testCrossDomainAcceptPrefEnabled() {
+  await trigger401AndHandle(true, true, true);
+});
+
+/**
+ * Tests that the 401 auth spoofing mechanisms do not apply if "privacy.authPromptSpoofingProtection" is not set to true
+ * canceling the prompt
+ */
+add_task(async function testCrossDomainCancelPrefDisabled() {
+  await trigger401AndHandle(false, true, false);
+});
+
+/**
+ * Tests that the 401 auth spoofing mechanisms do not apply if "privacy.authPromptSpoofingProtection" is not set to true,
+ * accepting the prompt
+ */
+add_task(async function testCrossDomainAcceptPrefDisabled() {
+  await trigger401AndHandle(true, true, false);
 });
 
 /**
  * Tests that the 401 auth spoofing mechanisms are not triggered by a 401 within the same base domain as the current sites,
  * canceling the prompt
  */
-add_task(async function testSameDomainCancel() {
-  await trigger401AndHandle(false, false);
+add_task(async function testSameDomainCancelPrefEnabled() {
+  await trigger401AndHandle(false, false, true);
 });
 
 /**
  * Tests that the 401 auth spoofing mechanisms are not triggered by a 401 within the same base domain as the current sites,
  * accepting the prompt
  */
-add_task(async function testSameDomainAccept() {
-  await trigger401AndHandle(true, false);
+add_task(async function testSameDomainAcceptPrefEnabled() {
+  await trigger401AndHandle(true, false, true);
 });

browser/base/content/test/tabPrompts/browser_auth_spoofing_url_copy.js

@@ -23,6 +23,9 @@ const AUTH_URL = TEST_PATH_AUTH + "auth-route.sjs";
  *
  */
 async function trigger401AndHandle() {
+  await SpecialPowers.pushPrefEnv({
+    set: [["privacy.authPromptSpoofingProtection", true]],
+  });
   let dialogShown = waitForDialogAndCopyURL();
   await BrowserTestUtils.withNewTab(CROSS_DOMAIN_URL, async function() {
     await dialogShown;