163768 - Prevent web content from accessing non-XBL anonymous content

Status: RESOLVED DUPLICATE of bug 164086

(Core :: Security, defect)

Description

[John Keiser (jkeiser)]

Some of our inputs use anonymous content, particularly input type=text input
type=file.  It is a Bad Thing when users access this stuff.  We should put a
check in the JS wrapper / classinfo code that prevents creation of a wrapper if:

(1) the content is anonymous (this could be a bit in mFlags for efficient checking)
(2) the content is non-XBL (we think bindingParent will tell us this--need to
ensure that bindingParent is null in the case of anonymous children of an input
type=file that is itself an anonymous child of XBL)
(3) web content is accessing it

This preemptively strikes a whole class of input type=file exploits and prevents
users from meddling where they aren't wanted.  Chrome could create a JS wrapper
and hand it to web content, but that is a less likely situation (at least in the
current world).

Comment 1

[John Keiser (jkeiser)]

Also, when this gets fixed we should get rid of the fix for bug 163598 since it
will be redundant.

Comment 2

[Christopher Aillon (sabbatical, not receiving bugmail)]

Since this alludes to what the fix is for 163598 (and thus making guessing the
security bug easier), marking this security sensitive to be on the safe side.

Comment 3

[John Keiser (jkeiser)]

We went with this solution for bug 164086.

*** This bug has been marked as a duplicate of 164086 ***