a few ABE INC & origin questions/issues

Discussions about the Application Boundaries Enforcer (ABE) module
al_9x
Master Bug Buster
Posts: 931
Joined: Thu Mar 19, 2009 4:52 pm

a few ABE INC & origin questions/issues

Post by al_9x »

  1. Code: Select all

    Site localhost
    Deny INC
    
    blocks the favicon request as inclusion of chrome://browser/content/browser.xul

    Code: Select all

    [ABE] <localhost> Deny INCLUSION on {GET http://localhost/favicon.ico <<< chrome://browser/content/browser.xul - 1}
    USER rule:
    Site localhost
    Deny INCLUSION
    
    but

    Code: Select all

    Site localhost
    Accept from SELF
    Deny INC
    
    doesn't block the favicon, suggesting that the origin is localhost. If the origin is chrome: why would SELF or localhost match it? And the more general question, how should ABE treat chrome: origins? What are some other chrome: cases? requests from extensions?
  2. Code: Select all

    Site localhost
    Accept from SELF
    Deny INC
    
    blocks a feed request, whose origin is "feed://<url of the parent page>"
    There are two issues here:
    1. since a feed request is a top level, replacement navigation, why should it be treated as INCLUSION? It's type is TYPE_OTHER and NS regards that as INCLUSION, but it's possible to have exceptions when appropriate.
    2. even if treated as an INCLUSION, why shouldn't "Accept from (SELF|localhost)" match the feed: origin?
Mozilla/5.0 (Windows NT 5.1; rv:6.0) Gecko/20100101 Firefox/6.0
User avatar
Giorgio Maone
Site Admin
Posts: 9526
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: a few ABE INC & origin questions/issues

Post by Giorgio Maone »

al_9x wrote: If the origin is chrome: why would SELF or localhost match it? And the more general question, how should ABE treat chrome: origins? What are some other chrome: cases? requests from extensions?
chrome://browser/content/browser.xul is special-cased to match SELF because it's the origin of manual navigation acts (e.g. from the URL bar).
al_9x wrote:
  1. since a feed request is a top level, replacement navigation, why should it be treated as INCLUSION? It's type is TYPE_OTHER and NS regards that as INCLUSION, but it's possible to have exceptions when appropriate.
  2. even if treated as an INCLUSION, why shouldn't "Accept from (SELF|localhost)" match the feed: origin?
feed: URLs probably need to be unwrapped and/or special-cased as well. TODO.
Mozilla/5.0 (Windows NT 5.2; WOW64; rv:6.0) Gecko/20100101 Firefox/6.0
Post Reply