37333 - Implement 4.X signed script syntax

Status: RESOLVED INVALID

(Core :: Security, defect, P3)

Description

[Mitchell Stoltz (not reading bugmail)]

Implement full backwards compatibility for signed scripts, with <SCRIPT ARCHIVE=
> and ID= tags.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Setting target M16...hopefully this will get into PR2.

Comment 2

[Phil Peterson]

[nsbeta2+]

Comment 3

[Mitchell Stoltz (not reading bugmail)]

*** Bug 37481 has been marked as a duplicate of this bug. ***

Comment 4

[Mitchell Stoltz (not reading bugmail)]

*** Bug 38851 has been marked as a duplicate of this bug. ***

Comment 5

[Mitchell Stoltz (not reading bugmail)]

I have implemented a solution for this as regards SCRIPT tags. The sticking point 
is with event handlers. Verifying signatures on event handlers will require a 
change to the parser by rickg (need access to the unmodified html source of tags 
containing event handlers in the HTML content sink). Adding 'waiting on 
dependency' to the whiteboard. his will proably not get dome by 5/16 but I think 
it's important enough to allow checking in later. 

Comment 6

[Paul Wyskoczka]

Changed QA contact to Cathy.

Comment 7

[leger]

mstoltz, is there a short cut that loses functionality, but gives us security?

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Jan,
   Signed scripts are currently working using pages accessed from archives using
jar:http://... I just don't think too many people will want to use it this way
since it means keeping a separate copy of your HTML page in a jar file. Full
backwards compatibility is waiting on rickg's changes. I have emailed him but
with no response. Without his changes, I could make it so that scripts in
<SCRIPT> tags could be signed, but not event handlers. Event handlers are in
pretty common use, so this would be pretty limiting to functionality. I'd really
like to get full functionality into beta2 - rickg said it would be approved by
exception after his changes are in, and I would only require a day or two of
coding once his changes are in.

Comment 9

[rickg]

I'm looking into this; I'll contact mstolz.

Comment 10

[rickg]

I've spoken with mstoltz, and we've agreed to break the problem up into tasks 
that we'll examine over the weekend. We further agreed to discuss the problem 
further (based on our tasks) on Monday.

Comment 11

[rickg]

I'm doing some engineering work today/tonight that may resolve this. We've 
agreed to get in contact on Thursday.

Comment 12

[leger]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 13

[Mitchell Stoltz (not reading bugmail)]

Moving to M17. Not an M16 stopper.

Comment 14

[Mitchell Stoltz (not reading bugmail)]

We've decided that implementing full backwards compatibility is too difficult in 
relation to the current demand for signed scripts, which is probably low. 
Retargeting "Future"...maybe we'll reconsider this for 6.1.

Comment 15

[John Unruh]

Assigning QA to czhang

Comment 16

[leger]

Need to put the workaround in the PR2 release notes for developers.

Comment 17

[Mitchell Stoltz (not reading bugmail)]

The full explanation for this relnote is in 
http://www.mozilla.org/projects/security/components/jssec.html 
and can probably be summarized.

Comment 18

[John Unruh]

Mass changing QA to ckritzer.

Comment 19

[Mitchell Stoltz (not reading bugmail)]

*** Bug 59982 has been marked as a duplicate of this bug. ***

Comment 20

[verah (gone)]

Removing myself from the list of cc's.

Comment 21

[ekrock's old account (dead)]

Nominating for nsbeta1 consideration. NS will presumably want to get this fixed 
at some point for backward compatibility & to ease forward migration of 
customers, especially enterprise users, so would be good if it could get done 
for nsbeta1. If not, this could slip to the next major release as the # of 
users affected is indeed low.

Comment 22

[Mitchell Stoltz (not reading bugmail)]

Mass adding mozilla0.9 keyword (mass changing milestone doesn't seem to work).

Comment 23

[Mitchell Stoltz (not reading bugmail)]

performance, footprint, feature work, and re-architecture bugs will be addressed
in 0.9.8

Comment 24

[Mitchell Stoltz (not reading bugmail)]

Future

Comment 25

[Manuel Ruiz]

Hello
It seems that this code can't run in this new version, neither signing code aply:
:
<SCRIPT archive="/Sms/Comunes/link/general.jar" language="JavaScript1.2"
src="/Sms/Comunes/link/general.js"></SCRIPT>

Can you help me (It's works in a 4.73 version).It's very critical because i can
modify locationbar.visible, etc...of anyway
Tankyou
	netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserWrite");
	self.menubar.visible=false;
	self.toolbar.visible=false;
	self.locationbar.visible=false;
	self.location.visible=false;
	self.personalbar.visible=false;
	self.scrollbars.visible=false;
	self.statusbar.visible=true;
	self.resizable=false;

	self.resizeTo(500,400);
	netscape.security.PrivilegeManager.disablePrivilege("UniversalBrowserWrite");

Thank youso much	

Manuel Ruiz Camacho
Comunicaciones
C/ Velazquez 132, Bloque II - 2ª Planta
28006 - Madrid (ESPAÑA)
Tel:  [phone]
Fax: [phone]
[e-mail]
http://www.indra.es

Comment 26

[Vinay]

NS6 and now NS7 also does not support the NS 4.x following signed-script policy.
<SCRIPT language="JavaScript1.2" archive="xyz.jar"  src="xyz.js"></SCRIPT>

This critical defect is breaking NS 6/7 from past 3 years. We would like 
archive option back in Script tag to support the signed scripts.

Comment 27

[Mitchell Stoltz (not reading bugmail)]

*** Bug 143289 has been marked as a duplicate of this bug. ***

Comment 28

[Vinay Prakash]

NS 7.1 does not support the NS 4.x following signed-script policy.
<SCRIPT language="JavaScript" archive="a.jar"  src="a.js"></SCRIPT>

This critical defect is breaking NS 7.1 forever. Please add archive option back 
in Script tag to support the signed scripts.

Comment 29

[Darin Fisher]

vinay,

it is highly unlikely that this feature will be implemented anytime soon by the
folks who were previously involved with this bug since they are no longer
working on mozilla with any regular frequency.

if this feature is important to you or your company please bring it to the
attention of the Mozilla Foundation (mailto:[e-mail]).  this is the
best way to escalate a feature request, especially if it is critical to the
deployment of mozilla in your organization.

thank you,
darin

Comment 30

[Jean-Marc Desperrier]

In the current circonstances, it doesn't seem likely support for this will be
added. Mozilla.org has already too many urgent bugs to solve.

A more reasonnable option for anyone bloqued by this problem would be to change
the way you are working to use instead the newer method for Mozilla to access
the signed script :
http://www.mozilla.org/projects/security/components/jssec.html#signedscript

It might be annoying, but if you just wait for this to change, you risk to be
waiting and missing the multiple progresses of mozilla over Netscape 4.x a very
long time yet.

Comment 31

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Now we don't support signed scripts at all.