Closed Bug 262689 Opened 20 years ago Closed 20 years ago

lock icon and certificates spoofable with "view-source:"

Categories

(Core :: Security, defect)

Product:
Core
Component:
Security
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: u115577, Assigned: jst)

References

(Blocks 1 open bug)

Details

(Keywords: fixed-aviary1.0, fixed1.4.4, fixed1.7.5, Whiteboard: [sg:fix])

Attachments

(2 files)

Testcase
187 bytes, text/html
Details
Fix. Don't let nsSecureBrowserUIImpl get stuck in view-source mode.
3.34 KB, patch
caillon
: review+
dveditz
: superreview+
asa
: approval-aviary+
asa
: approval1.7.5+
Details | Diff | Splinter Review 
User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; ja-JP; rv:1.7.3) Gecko/20041001 Firefox/0.10.1
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; ja-JP; rv:1.7.3) Gecko/20041001 Firefox/0.10.1

I found a security issue with "view-source:".

When I viewed the source of a secure site in the browser window (e.g.
"view-source:https://bugzilla.mozilla.org/" with a bookmarklet instead of
Ctrl+U), the lock icon and certificates were kept in the location bar. 

So I thought this bug can be used for the certificate spoofing.
I wrote simple testcase based on Bug 253121.

Reproducible: Always
Steps to Reproduce:
1. Load testcase
2. Right click page -> View Page Info, go to security tab
3. Notice that the site (mozilla.org) appears to be secure, 
   and the certificate from https://www.paypal.com/ is shown
Attached file Testcase — 

    
    

    
  
Source of testcase:

<html>
<head>
<meta http-equiv="refresh" content="0;url=view-source:https://www.paypal.com/">
</head>
<body onunload="window.location.replace('http://www.mozilla.org/');"></body>
</html>


    
    

    
  
Site name with lock icon on status bar (Firefox) is also spoofable.

[1] http://www.aaa.com/
     |
 (redirect) <= certificate of [2] https://www.bbb.com/
     | 
[3] http://www.ccc.com/

In this case, site name on status bar will be "www.aaa.com".
But if [3] is http://www.aaa.com/ddd/, it is easier to lead users to believe
that "www.aaa.com" is secure.

Once the certificate is issued, browser (tab) keeps it after that.

    
    

    
  
->Johnny who fixed similar bug 253121
Confirming in both Firefox and Mozilla Suite.

Probably should block Aviary; presuming so, chofmann can clear if he disagrees.
Assignee: dveditz → jst
Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: blocking-aviary1.0+
Whiteboard: [sg:fix]

    
    

    
  
Bookmarklet I used:

  javascript: location.href = 'view-source:' + location.href;

Save on Bookmarks Toolbar, go to secure (https:) site, and just click it.
"view-source:" urls seem to bypass security checks :-(

    
  

        Attachment #161523 -
        Flags: superreview?(dveditz)

        Attachment #161523 -
        Flags: review?(caillon)

    
    

    
  
Comment on attachment 161523 [details] [diff] [review]
Fix. Don't let nsSecureBrowserUIImpl get stuck in view-source mode.

This makes sense, and if jst has tested it, all the better.  The old code was
bad, and this is a good change nonetheless.  r=caillon

        Attachment #161523 -
        Flags: review?(caillon) → review+

    
  
Whiteboard: [sg:fix] → [sg:fix] have need review dveditz

    
    

    
  
Comment on attachment 161523 [details] [diff] [review]
Fix. Don't let nsSecureBrowserUIImpl get stuck in view-source mode.

sr=dveditz

        Attachment #161523 -
        Flags: superreview?(dveditz) → superreview+

    
  

        Attachment #161523 -
        Flags: approval1.7.x?

        Attachment #161523 -
        Flags: approval-aviary?

    
    

    
  
Comment on attachment 161523 [details] [diff] [review]
Fix. Don't let nsSecureBrowserUIImpl get stuck in view-source mode.

a=asa for branches checkins.

        Attachment #161523 -
        Flags: approval1.7.x?

        Attachment #161523 -
        Flags: approval1.7.x+

        Attachment #161523 -
        Flags: approval-aviary?

        Attachment #161523 -
        Flags: approval-aviary+

    
    

    
  
Fixed on trunk and branches.
Status: NEW → RESOLVED
Closed: 20 years ago
Keywords: fixed-aviary1.0, 
          
            fixed1.7.x
Resolution: --- → FIXED

    
    

    
  
I confirmed that testcase didn't work with 2004-10-09 Branch for Mac.
But location bar was still yellow when I opened the following link
view-source:https://bugzilla.mozilla.org/

Of course bookmarklet (see comment 5) produced the same result.

Is this ok?

    
    

    
  
(In reply to comment #11)
> I confirmed that testcase didn't work with 2004-10-09 Branch for Mac.
> But location bar was still yellow when I opened the following link
> view-source:https://bugzilla.mozilla.org/
> 
> Of course bookmarklet (see comment 5) produced the same result.
> 
> Is this ok?

Yes, that's fine as long as the certs used are from the right host
(bugzilla.mozilla.org in this case) and not from any other site.
Blocks: lockicon
Whiteboard: [sg:fix] have need review dveditz → [sg:fix]

    
    

    
  
Security Advisories published, clearing confidential flag
Group: security

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: