Benjamin Beurdouche
f158cf08b8
Follow-up to D270165 addressing reviewer comments outside security/keystore/ and adding a profile-encryption launch guard: - Add a database-at-rest launch guard. nsAppRunner reads an EncryptedDatabases marker from compatibility.ini early in XRE_mainStartup and refuses to launch (alert + clean exit) rather than corrupt data when the profile's on-disk state and the security.storage.encryption.sqlite.enabled pref disagree: an encrypted profile opened by a pref-off build, or plaintext databases under a pref-on build (the latter detected by reading the SQLite header's 8192-byte-page / 32-reserved-byte obfsvfs signature, no mozStorage). The gate is skipped in backgroundtask mode. The EncryptedDatabases flag is read in CheckCompatibility (which already parses compatibility.ini) and written by a new nsIXULRuntime.markProfileEncryptedDatabases (append-only, modeled on invalidateCachesOnRestart), with an xpcshell test; the storage layer wires the marker write on profile-after-change in the lockstore commit. - Drop duplicate hasKey/mDatabaseEncrypted assignment and clarify the "outside profile" fallback comments in Connection::initialize. - Restore explicit `return rv` at the three sqlite3_open failure sites that the original patch had switched to NS_ENSURE_SUCCESS. - Strengthen the security.storage.encryption.sqlite.enabled pref description to flag it INTERNAL / DO NOT ENABLE pending the enterprise-policy gate in the rest of the stack. - Replace the mozilla_net_percent_encode Rust addition in netwerk/base/idna_glue with a call to NS_EscapeURLSpan(esc_FilePath | esc_Forced) inside a new shared helper, storage::PreparePathForURI, exported via storage/StoragePathUtil.h. NS_EscapeURLSpan covers '?', '#', '&', space, etc. -- not just '%'. - Expose obfsvfs::kObfsPageSize from ObfuscatingVFS.h so that Connection::GetDefaultPageSize and ObfuscatingVFS.cpp share the same 8192 constant instead of duplicating literals. - Use storage::PreparePathForURI in toolkit/components/places/ Database.cpp::AttachDatabase before building the file: URI, so paths containing URI-significant bytes don't produce malformed URIs. - Make ExtractURIPathAndQuery tolerant of bare filesystem paths. PRAGMA database_list returns normalized filenames (no file: prefix), so the encrypted-clone branch was previously returning NS_ERROR_FAILURE and breaking Connection::initializeClone for encrypted DBs with attached databases. - Track the pending mozIStoragePendingStatement returned by attachDatabase in Sqlite.sys.mjs's _pendingStatements map, matching the _executeStatement pattern, so shutdown can cancel in-flight ATTACH operations instead of leaking them. - Parameterize test_page_size_is_32k.js on the encryption pref (8 KiB when on, 32 KiB when off) and drop its pref override in xpcshell.toml. - Strengthen the comment in dom/indexedDB/test/marionette/ manifest.toml about the PBM x obfsvfs interaction gap and reference a pending follow-up bug. Differential Revision: https://phabricator.services.mozilla.com/D301054
32 lines
764 B
C++
32 lines
764 B
C++
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "mozilla/storage/StoragePathUtil.h"
|
|
|
|
#include <cctype>
|
|
|
|
#include "nsEscape.h"
|
|
#include "nsString.h"
|
|
|
|
namespace mozilla::storage {
|
|
|
|
void PreparePathForURI(nsACString& aPath) {
|
|
#ifdef _WIN32
|
|
if (aPath.Find(R"(\\?\)") == 0) {
|
|
aPath.Cut(0, 4);
|
|
}
|
|
|
|
aPath.ReplaceChar('\\', '/');
|
|
if (aPath.Length() >= 2 && std::isalpha(aPath[0]) && aPath[1] == ':') {
|
|
aPath.Insert('/', 0);
|
|
}
|
|
#endif
|
|
nsAutoCString escaped;
|
|
if (NS_EscapeURLSpan(aPath, esc_FilePath | esc_Forced, escaped)) {
|
|
aPath = escaped;
|
|
}
|
|
}
|
|
|
|
} // namespace mozilla::storage
|