It appears that when DevTools is attached to a RenderFrame, the browser process grants it access to "raw cookies" in ChildProcessSecurityPolicy and sends cookie values to the renderer process.
This should be modified to prevent leaking cookie values of sites that require dedicated processes, in case the renderer process is compromised. This may involve a temporary degradation in the DevTools UI by not displaying the cookie values for these sites, unless the UI can be populated without sending the values to the renderer.
In --site-per-process mode, all sites require dedicated processes, and we should not send any cross-site cookies to the renderer. Otherwise, we should consult the list of isolated origins and ensure that none of their cookies are sent to a renderer which is not locked to their origin.
You can use a check like the one in CrossSiteDocumentResourceHandler to determine if a site needs protecting:
if (SiteIsolationPolicy::UseDedicatedProcessesForAllSites() ||
ChildProcessSecurityPolicyImpl::GetInstance()->IsIsolatedOrigin(
url::Origin::Create(url))) {
...
ChildProcessSecurityImpl::CanAccessDataForOrigin could also be used to tell if a given process has access to the cookies for an origin already (e.g., see RenderFrameMessageFilter::GetCookies).
pfeldman: Can you help triage?
![https://www.chromium.org/_/rsrc/1220197576998/Home/flying_browser.png";](https://www.chromium.org/_/rsrc/1220197576998/Home/flying_browser.png";){kind=link}
Comment 1 by pfeldman@chromium.org
, Dec 11 2017Status: Assigned (was: Untriaged)