[tor-bugs] #5742 [Firefox Patch Issues]: Fix image cache url isolation

[Tor Bug Tracker & Wiki]

#5742: Fix image cache url isolation
----------------------------------------------+-----------------------------
 Reporter:  mikeperry                         |          Owner:  mikeperry
     Type:  defect                            |         Status:  new      
 Priority:  major                             |      Milestone:           
Component:  Firefox Patch Issues              |        Version:           
 Keywords:  tbb-linkability, MikePerry201207  |         Parent:           
   Points:  20                                |   Actualpoints:  4        
----------------------------------------------+-----------------------------
Changes (by mikeperry):

  * actualpoints:  2 => 4


Comment:

 Some more useful tidbits: nsIHttpChannelInternal actually has a
 documentURI getter and setter that seems to provide the top-level url that
 was used during a load. It gets set in nsDocShell, so it may not be
 present for all image loads, but we can at least test it out in
 imgLoader::LoadImageWithChannel(). If the channel fails to QI and/or the
 getter fails, I suppose we could just bypass the cache (perhaps with an
 Error Console warn somehow or something?).

 Additionally, it appears that the documentURI in imgLoader::LoadImage()
 might actually be what we need when it is actually non-null, but we should
 test nested iframes and/or inspect the callers more closely to be sure.
 Perhaps we can also bypass cache and log if that parameter is null.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5742#comment:8>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online