296902 - Check whether XPCNativeWrapper needs security checks

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

We have various same-origin type security checks in DOMClassInfo that I don't
see happening in XPCNativeWrapper.  Since content can manually construct
XPCNativeWrapper objects, perhaps we need some checks?  Note that I haven't
managed to actually produce an XSS exploit yet, so maybe we're OK; I just can't
figure out _why_ exceptions are getting thrown when they are.

Comment 1

[Daniel Veditz [:dveditz]]

Maybe shutdown or moz_bug_r_a4 could turn this into an exploit

Comment 2

[Brendan Eich [:brendan]]

Someone remind me of the other bug bz filed, asking for XPCNativeWrapper to call
the scriptable helper hooks, for hi-fi DOM level 0 emulation.

/be

Comment 3

[Brendan Eich [:brendan]]

bc kindly pointed out bug 296967 over IRC.

/be

Comment 4

[shutdown]

(In reply to comment #1)
> Maybe shutdown or moz_bug_r_a4 could turn this into an exploit

I've filed bug 299450. please check.

Comment 5

[Brendan Eich [:brendan]]

This is fixed now that its dependencies are fixed.  bz can verify next week.

/be

Comment 6

[Mike Connor [:mconnor]]

If this gets reopened, we probably need to see it on the blocker list.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Yeah, I think with the dependencies fixed this is all good.