52093 - Remote Web pages can acquire godlike power

Status: VERIFIED FIXED

(Core :: XBL, defect, P1)

Description

[David Hyatt]

I have a flawed API on DocumentXBL, loadBindingDocument, that doesn't do any 
security checks.  It can be used to hand back a trusted document to an untrusted 
document.  

I need to plug this call to do a same-domain check, etc.

Comment 1

[David Hyatt]

Nominating for nsbeta3

Comment 2

[David Hyatt]

This is so obviously a + that I'm doing it myself.

Comment 3

[David Hyatt]

This problem doesn't exist in PR1 or 2, so breathe easy.

Comment 4

[Peter Trudelle]

nsbeta3+, P1 for M18

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Dave, let me know if you need a review, etc, for this.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Could you send me a testcase for this exploit? I'd like to add it to the security 
test suite.

Comment 7

[Michael La Guardia]

PDT agrees P1

Comment 8

[David Hyatt]

<html>
<body>
I look like a simple Web page, but if you click on the button to the right,
I will acquire godlike powers and bust out all over your ass.

<button onclick="
var godDoc = 
document.loadBindingDocument('chrome://global/content/xulBindings.xml');
if (godDoc) {
  alert('You've got chrome! Uh-oh!\n');
}
">
Click me to get some chrome, baby.
</button>
</body>
</html>

Comment 9

[Mitchell Stoltz (not reading bugmail)]

please fix this for beta3!

Comment 10

[David Hyatt]

Fixed.

Comment 11

[John Morrison]

verified fixed 2000091508 linux/mac/win32 for the test above. No mo' chrome.
(Note to self: test is at http://jrgm.mcom.com/bugs/52093/god-like-xbl.html)