1029253 - (shumway) Redirects on policy files should be disallowed

Status: RESOLVED INCOMPLETE

(Firefox Graveyard :: Shumway, defect)

Description

[Matt Wobensmith [:mwobensmith][:matt:]]

This pertains to content that loads data via flash.net.URLLoader, but likely affects all Flash data-loading APIs.

Currently, Shumway supports master policy files named crossdomain.xml that are located in the root directory of a web server. However, if the file is redirected, the policy file at the final URL is honored. This should be disallowed.

Policy file spec:
http://www.senocular.com/pub/adobe/crossdomain/policyfiles.html

Comment 1

[Matt Wobensmith [:mwobensmith][:matt:]]

Rephrased, this is a security issue. A malicious SWF could retrieve a permissive policy file from a domain it controls, and the domain could redirect to a 3rd party and/or intranet site, to perform CSRF.