159605 - image map editor uses eval incorrectly

Status: RESOLVED WONTFIX

(SeaMonkey :: Composer, defect)

Description

[Jesse Ruderman]

cutCopy() contains code like this:
  clipboardItem[i] = 'Poly(\"'+coords+'\", \"'+href+'\", \"'+target+'\",
\"'+alt+'\", true)';

paste() contains code like this:
  eval(clipboard[i])

If an attribute includes a " character, this code will fail.  If an attribute
contains malicious code such as "+alert(Components.classes)+", copying and
pasting in the image map editor will execute the malicious code with chrome
privs.  I haven't actually tested this because the image map editor is disabled.

The image map editor could use code like this to avoid reparsing:

clipboard[i] = { func:Poly, params:[coords,href,target,alt,true] }

clipboard[i].func.apply(window, clipboard[i].params);

Comment 1

[Syd Logan]

--> cmanske

Comment 2

[Kathleen :Brade]

removing nsbeta1+; seeking re-triage
image map editor is not currently part of the build

Comment 3

[Samir Gehani]

Composer triage team: nsbeta1-

Comment 4

[Mitchell Stoltz (not reading bugmail)]

This could be a serious security bug - please make sure this is fixed *before*
the feature is added to the build.

Comment 5

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: patch

Comment 6

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: patch

Comment 7

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Comment on attachment 170292 [details] [diff] [review]
patch

Note that the patch does not make the situation with newlines at the end of the
file worse (biesi confirmed this).

Comment 8

[[e-mail]]

Comment on attachment 170292 [details] [diff] [review]
patch

There's no point serializing an element to a string that we're not going to
evaluate. Might as well just put clones of the element in the clipboard and
append them when you paste.

Comment 9

[Robert Kaiser]

MASS-CHANGE:
This bug report is registered in the SeaMonkey product, but has been without a comment since the inception of the SeaMonkey project. This means that it was logged against the old Mozilla suite and we cannot determine that it's still valid for the current SeaMonkey suite. Because of this, we are setting it to an UNCONFIRMED state.

If you can confirm that this report still applies to current SeaMonkey 2.x nightly builds, please set it back to the NEW state along with a comment on how you reproduced it on what Build ID, or if it's an enhancement request, why it's still worth implementing and in what way.
If you can confirm that the report doesn't apply to current SeaMonkey 2.x nightly builds, please set it to the appropriate RESOLVED state (WORKSFORME, INVALID, WONTFIX, or similar).
If no action happens within the next few months, we move this bug report to an EXPIRED state.

Query tag for this change: mass-UNCONFIRM-20090614

Comment 10

[Jesse Ruderman]

Do not expire security bugs.

Comment 11

[Philip Chee]

This code does not exist in the tree any more. Removed in Bug 717240
=>INVALID/WONTFIX.