Bug 211092 – Web Inspector: Storage: can see third-party cookies

• Component: Web Inspector
• Status: RESOLVED FIXED

[Devin Rousso]

The early return if the given `WebFrame` is the main frame means that if a third-party resource is loaded into the main frame, and cookies are queried for that third-party's resource in the main frame, we will allow cookie access even though it's a third-party resource simply because it was loaded into the main frame.  This is incorrect, as we should always verify that the domain of the url being used to query for cookies matches the first-party domain before granting access.

[Devin Rousso]

<rdar://problem/62469078>

[Devin Rousso]

Created attachment 397741 [details]
Patch

[Darin Adler]

No test?

[Devin Rousso]

(In reply to Darin Adler from comment #3)
> No test?
I'm working on that now :)

[Maciej Stachowiak]

Whether media elements get cookies in a third party context is probably tricky to test but definitely not impossible to test, and we certainly want to avoid similar bugs in the future.

[Maciej Stachowiak]

Comment on attachment 397741 [details]
Patch

r- for lack of test for now

[Chris Dumez]

(In reply to Maciej Stachowiak from comment #5)
> Whether media elements get cookies in a third party context is probably
> tricky to test but definitely not impossible to test, and we certainly want
> to avoid similar bugs in the future.

I added Jer & Eric for advice. If I remember correctly, this is used by AirPlay on macOS only (and Web Inspector but I guess we are more concerned about the media case).

[Eric Carlson]

Comment on attachment 397741 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=397741&action=review

> Source/WebKit/ChangeLog:9
> +        The early return if the given `WebFrame` is the main frame means that if a third-party

s/is the main frame/in the main frame/

[Eric Carlson]

(In reply to Chris Dumez from comment #7)
> 
> I added Jer & Eric for advice. If I remember correctly, this is used by
> AirPlay on macOS only (and Web Inspector but I guess we are more concerned
> about the media case).

getRawCookies is used for media on iOS only, see MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL.

MediaPlayerPrivateAVFoundationObjC ultimately gets the cookies from HTMLMediaElement::mediaPlayerGetRawCookies, so you could add something to Internals similar to what we did for response sources in Internals::mediaResponseSources.

[Devin Rousso]

Created attachment 397755 [details]
Patch

[Chris Dumez]

Comment on attachment 397755 [details]
Patch

r=me

[EWS]

Committed r260807: <https://trac.webkit.org/changeset/260807>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 397755 [details].