Untested attempt at securing JS cookies.

Mike Perry · pde · commit 5d3a0314bd3b · 2011-10-15T11:59:34.000-07:00
diff --git a/src/chrome/content/code/HTTPS.js b/src/chrome/content/code/HTTPS.js
@@ -219,6 +219,16 @@ const HTTPS = {
       
     }
   },
+
+  handleInsecureCookieEvent: function(c) {
+    if (HTTPSRules.shouldSecureCookie(null, c)) {
+      this.log(INFO, "Securing cookie from event: " + c.domain + " " + c.name);
+      var cookieManager = Components.classes["@mozilla.org/cookiemanager;1"]
+                            .getService(Components.interfaces.nsICookieManager);
+      cookieManager.remove(c.host, c.name, c.path, false);
+      cookieManager.add(c.host, c.path, c.name, c.value, true, c.isHTTPOnly, c.isSession, c.expiry);
+    }
+  },
   
   handleCrossSiteCookies: function(req, origin, browser) {
      
diff --git a/src/chrome/content/code/HTTPSRules.js b/src/chrome/content/code/HTTPSRules.js
@@ -506,9 +506,9 @@ const HTTPSRules = {
           }
         }
         if (ruleset.cookierules.length > 0)
-          applicable_list.moot_rule(ruleset);
+          if (applicable_list) applicable_list.moot_rule(ruleset);
       } else if (ruleset.cookierules.length > 0) {
-        applicable_list.inactive_rule(ruleset);
+        if (applicable_list) applicable_list.inactive_rule(ruleset);
         this.log(INFO,"Inactive cookie rule " + ruleset.name);
       }
     }
diff --git a/src/components/https-everywhere.js b/src/components/https-everywhere.js
@@ -430,6 +430,28 @@ HTTPSEverywhere.prototype = {
     } else if (topic == "http-on-examine-merged-response") {
       this.log(DBUG, "Got http-on-examine-merged-response ");
       HTTPS.handleSecureCookies(channel);
+    } else if (topic == "cookie-changed") {
+      // Javascript can add cookies via document.cookie that are insecure.
+      // It might also be able to 
+      if (data == "added" || data == "changed") {
+        // subject can also be an nsIArray! bleh.
+        try {
+          subject.QueryInterface(Ci.nsIArray);
+          var elems = subject.enumerate();
+          while (elems.hasMoreElements()) {
+            var cookie = elems.getNext()
+                            .QueryInterface(Ci.nsICookie2);
+            if (!cookie.isSecure) {
+              HTTPS.handleInsecureCookie(cookie);
+            }
+          }
+        } catch(e) {
+          subject.QueryInterface(Ci.nsICookie2);
+          if(!subject.isSecure) {
+            HTTPS.handleInsecureCookie(subject);
+          }
+        }
+      }
     } else if (topic == "app-startup") {
       this.log(DBUG,"Got app-startup");
     } else if (topic == "profile-before-change") {
@@ -440,6 +462,7 @@ HTTPSEverywhere.prototype = {
       Thread.hostRunning = false;
     } else if (topic == "profile-after-change") {
       this.log(DBUG, "Got profile-after-change");
+      OS.addObserver(this, "cookie-changed", false);
       OS.addObserver(this, "http-on-modify-request", false);
       OS.addObserver(this, "http-on-examine-merged-response", false);
       OS.addObserver(this, "http-on-examine-response", false);

Original file line number	Diff line number	Diff line change
`@@ -506,9 +506,9 @@ const HTTPSRules = {`
`506`	`506`	`}`
`507`	`507`	`}`
`508`	`508`	`if (ruleset.cookierules.length > 0)`
`509`		`- applicable_list.moot_rule(ruleset);`
	`509`	`+ if (applicable_list) applicable_list.moot_rule(ruleset);`
`510`	`510`	`} else if (ruleset.cookierules.length > 0) {`
`511`		`- applicable_list.inactive_rule(ruleset);`
	`511`	`+ if (applicable_list) applicable_list.inactive_rule(ruleset);`
`512`	`512`	`this.log(INFO,"Inactive cookie rule " + ruleset.name);`
`513`	`513`	`}`
`514`	`514`	`}`