144704 - javascript: url loaded from bookmark sidebar or manager runs as chrome

Status: VERIFIED FIXED

(Core :: Security: CAPS, defect)

Description

[Jesse Ruderman]

A javascript: URL loaded from any of the following places runs as chrome:

* bookmarks sidebar
* bookmark manager
* global history window
* global history sidebar

Example: javascript:try{x=String(Components.classes);}catch(er){x=er};x

The weird thing is that bookmarks loaded from these places run as chrome /and/
run in the context of the page in the content area.  How can they be both chrome
and part of the page?

Expected:
* javascript: urls loaded from bookmarks should run as part of the page
* javascript: urls loaded from global history should run as nothing

Bookmarklets run from the bookmarks menu and from the personal toolbar work as
expected.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Dan Veditz has offered to take this one.

Comment 2

[Brendan Eich [:brendan]]

Any news?  Today is the last day for 1.0rc3, which probably means for 1.0.

/be

Comment 3

[Daniel Veditz [:dveditz]]

I'm just learning my way on the security stuff. I plan on fixing it this week,
but if you want something immediate someone who knows what to look for already
should take it.

Comment 4

[Daniel Veditz [:dveditz]]

Attachment: Load javascript URIs safely

Comment 5

[Daniel Veditz [:dveditz]]

This bug is in the utility function openTopWin() which is called lots of places.
Many of them probably suffered from this bug. In addition to the bookmarks and
history problems in this bug, the view image (and background image) problem from
bug 143420 turns out to have the same cause. abCardViewOverlay.js is another one
to look into.

It doesn't look like any places would get broken by this change, but it'd be
good to get a second opinion or some trunk testing before landing this on the
branch.

Comment 6

[Brendan Eich [:brendan]]

Adding to the rc3-not-suck list, thanks dveditz.  Does walletOverlay.js need a
similar fix?  I see other foo._content.location{,.href} = ... patterns under
xpfe/components.

/be

Comment 7

[Brian Ryner (not reading)]

Comment on attachment 84409 [details] [diff] [review]
Load javascript URIs safely

r=bryner

Comment 8

[Brendan Eich [:brendan]]

Comment on attachment 84409 [details] [diff] [review]
Load javascript URIs safely

sr=[e-mail]

I believe this will be approved today for 1.0 branch checkin.  Please get it
into the trunk ASAP.

/be

Comment 9

[Dawn Endico]

Comment on attachment 84409 [details] [diff] [review]
Load javascript URIs safely

a=chofmann,scc

please check this in to the  mozilla 1.0 branch by midnight.

Comment 10

[scottputterman]

adding adt1.0.0+ for checkin to the 1.0 branch.

Comment 11

[Daniel Veditz [:dveditz]]

*** Bug 88143 has been marked as a duplicate of this bug. ***

Comment 12

[Daniel Veditz [:dveditz]]

Checked into trunk and branch

Comment 13

[bsharma]

Verified on 2002-10-11-branch build on Win2000.

Attached URL throws an exception.

Comment 14

[Daniel Veditz [:dveditz]]

Fixing verified keyword so queries of which bugs were fixed in what release come
out right: this was fixed for Mozilla 1.0