293671 - nsScriptSecurityManager::GetBaseURIScheme doesn't handle jar:view-source:

Status: RESOLVED FIXED

(Core :: Security, defect, P1)

Description

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

nsScriptSecurityManager::GetBaseURIScheme doesn't handle jar:view-source:...
correctly because the jar: and view-source: cases don't use recursion as they
ought to.  This provides a way to get around
nsIScriptSecurityManager.DISALLOW_JAVASCRIPT or DISALLOW_JAVASCRIPT_OR_DATA checks.

Testcase to be attached, variant of bug 290036 and bug 290949.

Comment 1

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: testcase

Comment 2

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Attachment: patch (use recursion)

Comment 3

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 183198 [details] [diff] [review]
patch (use recursion)

>Index: nsScriptSecurityManager.cpp

>-    while(PL_strcmp(scheme.get(), "view-source") == 0)
>+    if (PL_strcmp(scheme.get(), "view-source") == 0)

Since you're touching this, we should use libc's version of strcmp(), not the
PL version.

...

>-    //-- if uri is an about uri, distinguish 'safe' and 'unsafe' about URIs
>+    //-- if aURI is an about uri, distinguish 'safe' and 'unsafe' about URIs
>     static const char aboutScheme[] = "about";
>     if(nsCRT::strcasecmp(scheme.get(), aboutScheme) == 0)

The scheme is be normalized to all lowercase.  (Do we ever get schemes that
necko specifically knows about that are not lowercased?).  We can change this
to the libc strcmp() version.

r=caillon

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

My goal here was to change as little as possible; it's already using
EqualsLiteral on the trunk.

Comment 5

[Bob Clary [:bc] (inactive)]

<http://test.bclary.com/tests/mozilla.org/security/293671-01.html> version of
the testcase without code execution.

Comment 6

[Daniel Veditz [:dveditz] out until Nov 10]

Comment on attachment 183198 [details] [diff] [review]
patch (use recursion)

sr=dveditz

Comment 7

[Asa Dotzler [:asa]]

Comment on attachment 183198 [details] [diff] [review]
patch (use recursion)

a=asa

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Checked in to trunk (still matters for data:).

Comment 9

[Daniel Veditz [:dveditz] out until Nov 10]

Clearing security flag from announced vulnerabilities fixed in Firefox
1.0.4/Mozilla 1.7.8