[FF#1499592] Leaks at least 1 outbound request to any attacker

[James-E-A]

Consider an attacker who is aware of this Add-on.

They might:

• Allow the first request, for the root document, to go unmolested, but intercept other parallel connections and hijack the page via e.g. scripts
• Intercept the page, steal cookies, perhaps deposit persistent threats, etc. - then refresh to an unmolested connection before the user notices
• Do something even more creative

remember that in The Internet, you have other, aggressive intelligences finding ways your software diverges from what you thought you wrote… everything doesn't go "as planned"; you've got to be airtight or its utility is only marginal

[James-E-A]

Disturbingly, webRequest.onBeforeSendHeaders, which "is triggered before sending any HTTP data", does not provide access to the TLS certificate status... what it's curretly using, webRequest.onHeadersReceived, is "Fired when the HTTP response headers for a request are received", so it can't protect against the entire outbound request going to the attacker.

TODO: try webRequest.onSendHeaders? [EDIT: no-can-do—this API “is informational only” i.e. you can't use it to stop a bad request.]

[James-E-A]

onBeforeSendHeaders also doesn't have access to securityInfo … and the next one in line, onSendHeaders`, “is informational only” —i.e. you can't use it to stop a bad request.

Alas. So, it looks like we can't make a properly-failsafe constrainer with just the APIs given us. The best we can do (for now) is "throwing the breaker" after 1 full bad connection has already been made.

Perhaps, once the rest of the functionality's implemented, Mozilla would hear out our requests for better access.

[James-E-A]

https://security.stackexchange.com/questions/8145/does-https-prevent-man-in-the-middle-attacks-by-proxy-server#comment13466_8148

It's a fair assumption that (root and delegated) CAs will supply bogus certificates to their national intelligence agencies…
– Tom Hawtin, Former engineer in Java SE security for Oracle Corporation

[James-E-A]

https://bugzilla.mozilla.org/show_bug.cgi?id=1499592

[James-E-A]

a mitigation, for an attacker who isn't aware of this add-on: hook onBeforeRequest to do a "preflight check"