Follow-up to D270165 addressing reviewer comments outside security/keystore/
and adding a profile-encryption launch guard:
- Add a database-at-rest launch guard. nsAppRunner reads an
EncryptedDatabases marker from compatibility.ini early in
XRE_mainStartup and refuses to launch (alert + clean exit) rather than
corrupt data when the profile's on-disk state and the
security.storage.encryption.sqlite.enabled pref disagree: an encrypted
profile opened by a pref-off build, or plaintext databases under a
pref-on build (the latter detected by reading the SQLite header's
8192-byte-page / 32-reserved-byte obfsvfs signature, no mozStorage).
The gate is skipped in backgroundtask mode. The EncryptedDatabases flag
is read in CheckCompatibility (which already parses compatibility.ini)
and written by a new nsIXULRuntime.markProfileEncryptedDatabases
(append-only, modeled on invalidateCachesOnRestart), with an xpcshell
test; the storage layer wires the marker write on profile-after-change
in the lockstore commit.
- Drop duplicate hasKey/mDatabaseEncrypted assignment and clarify the
"outside profile" fallback comments in Connection::initialize.
- Restore explicit `return rv` at the three sqlite3_open failure sites
that the original patch had switched to NS_ENSURE_SUCCESS.
- Strengthen the security.storage.encryption.sqlite.enabled pref
description to flag it INTERNAL / DO NOT ENABLE pending the
enterprise-policy gate in the rest of the stack.
- Replace the mozilla_net_percent_encode Rust addition in
netwerk/base/idna_glue with a call to NS_EscapeURLSpan(esc_FilePath |
esc_Forced) inside a new shared helper, storage::PreparePathForURI,
exported via storage/StoragePathUtil.h. NS_EscapeURLSpan covers '?',
'#', '&', space, etc. -- not just '%'.
- Expose obfsvfs::kObfsPageSize from ObfuscatingVFS.h so that
Connection::GetDefaultPageSize and ObfuscatingVFS.cpp share the same
8192 constant instead of duplicating literals.
- Use storage::PreparePathForURI in toolkit/components/places/
Database.cpp::AttachDatabase before building the file: URI, so paths
containing URI-significant bytes don't produce malformed URIs.
- Make ExtractURIPathAndQuery tolerant of bare filesystem paths. PRAGMA
database_list returns normalized filenames (no file: prefix), so the
encrypted-clone branch was previously returning NS_ERROR_FAILURE and
breaking Connection::initializeClone for encrypted DBs with attached
databases.
- Track the pending mozIStoragePendingStatement returned by
attachDatabase in Sqlite.sys.mjs's _pendingStatements map, matching
the _executeStatement pattern, so shutdown can cancel in-flight
ATTACH operations instead of leaking them.
- Parameterize test_page_size_is_32k.js on the encryption pref (8 KiB
when on, 32 KiB when off) and drop its pref override in xpcshell.toml.
- Strengthen the comment in dom/indexedDB/test/marionette/
manifest.toml about the PBM x obfsvfs interaction gap and reference a
pending follow-up bug.
Differential Revision: https://phabricator.services.mozilla.com/D301054
Benjamin Beurdouche
f158cf08b8