162945 - Can't fetch addresses from yahoo address book

Status: RESOLVED DUPLICATE of bug 160339

(Core :: Security: CAPS, defect)

Description

[Bill Schott]

When using yahoo mail to compose a new message, I click on the To: link and it
calls up my address book.  I then check off one address and click the "Insert
Checked Contacts" button at the top of the screen.
At this time, the address book window goes blank but never closes nor does it
return the addresses to the message being composed.
This feature worked OK in the ".99" build, but has failed since I upgraded to
1.1b (2002072203).  I downloaded build 2002081508 and did another test but it
still fails.

Comment 1

[John Morrison]

This is a security issue. It may be that we are preventing yahoo from doing
something that would allow untrusted sites to compromise security, or it may
be a bug in our implementation. I'm not sure.

Here's the rough draft of what happens. First, you get the compose window,
which is at the URL

  http://us.f129.mail.yahoo.com/ym/Compose?queryString...

Then you popup your address book, which is at URL:

  http://us.address.mail.yahoo.com/yab2/us?queryString...

You check the names you want, then click on "Insert Checked Contacts". 
This submit the form from the address book window and returns the document 
from URL:

  http://us.f129.mail.yahoo.com/ym/KioskAB?queryString...

This returns a script which does the following:

  document.domain = "us.f129.mail.yahoo.com";
  /* if compose window not there, open new one given to, cc, and bcc */
  if (window.opener.document.Compose == null) {
      /* otherwise, call AddTo() to help fill-out fields */
  } else {
      AddTo('To', '"Baz Bar" <[e-mail]>');
  }
  setTimeout('window.close()', 100);

where AddTo() tries to set the 'To' field in the 'Compose' form of the 
compose window. 

This throws a JS exception (either in the null check above, or when it 
tries to manipulate the form in the other window):

  Error: uncaught exception: Permission denied to get 
         property HTMLDocument.Compose

I'm not sure whether this should or should not be allowed.

-> Security, cc: susiew, jaimejr based on the large user base this affects.

Comment 2

[Susie Wyshak]

Even though this is a dupe, that's a great description of the issue.

*** This bug has been marked as a duplicate of 19130 ***

Comment 3

[John Morrison]

You mean duplicate of bug http://bugzilla.mozilla.org/show_bug.cgi?id=160339

Comment 4

[Susie Wyshak]

Duh, yes sorry.

Comment 5

[Susie Wyshak]

*** This bug has been marked as a duplicate of 160339 ***