265987 - Cross-tab scripting issue

Status: RESOLVED FIXED

(SeaMonkey :: Tabbed Browser, defect)

Description

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

It is possible to create a page that when opened in a new tab replaces the tab
from which it was opened, by using "content.document".

Comment 1

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

Attachment: Testcase [may replace this tab if opened in new tab]

Testcase

Comment 2

[Boris Zbarsky [:bzbarsky]]

So to clarify, opening the testcase in a new tab overwrites the parent document
too.  It does change the URI in the URI field, so it's not a huge spoofing risk,
but it's still pretty disconcerting.

Comment 3

[Chris Thomas (CTho) [formerly [e-mail] [e-mail]]]

To get this to work, you have to have new tabs open in the background
(browser.tabs.loadInBackground set to true).

Note that this code is in use in the wild, although it appears to be accidental
(the malicious page I took it from had an iframe named "content").

Comment 4

[Brendan Eich [:brendan]]

Yikes.  Nominating.  Danm, whoever: how can |content| be bound in a content
window's DOM?

/be

Comment 5

[Johnny Stenback (:jst)]

Attachment: Don't return the primary content window to hidden tabs.

The problem here is that 'window.content' ends up leaking the current tab's
window into any and all tabs in the same window, whether they're visible or
not. That's not a security problem per se as the calling tab doesn't have
access to the calle in any other ways than it would if the callee had opened
the window. But it's still bad, and this plugs the hole as safely as I could...

Comment 6

[[e-mail]]

Interesting... so what will this do for a collapsed sidebar?

Comment 7

[Johnny Stenback (:jst)]

Attachment: Alternate patch that makes 'content' be null in non-chrome script.

This is an alternate fix for this bug, this makes 'content' be null, in stead
of the top-most same-type window (which it is in "normal cases" for non-chrome
callers). This *should* be fine as well, but it would break any existing code
on the web that assumes it can use content to reach the top window (same as
window.top). I don't know for a fact that such code exists tho.

Comment 8

[Brendan Eich [:brendan]]

Comment on attachment 163368 [details] [diff] [review]
Don't return the primary content window to hidden tabs.

sr/a=me.  Thanks again, jst.

/be

Comment 9

[Johnny Stenback (:jst)]

(In reply to comment #6)
> Interesting... so what will this do for a collapsed sidebar?

Depending on how a sidebar is hidden (i.e. depending on if
nsIBrowserWindow::GetVisible() says true or false) this could prevent a
collapsed sidebar from accessing the content window. Not an issue in Firefox
AFAIK though.

Comment 10

[Johnny Stenback (:jst)]

Fixed on branches.

Comment 11

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Is the collapsed-sidebar thing an issue on the 1.7.x branch for seamonkey, though?

Comment 12

[Tracy Walker [:tracy]]

testcase opens in a new background tab as seen on windows firefox branch build
2004102607

Comment 13

[sairuh (rarely reading bugmail)]

tested on linux fc2:

with 2004102509-0.9+, the new tab says "Replaced original tab"
with 2004102609-0.11, the new tab says "Replaced original tab  New tab content"

Comment 14

[Christopher Aillon (sabbatical, not receiving bugmail)]

(In reply to comment #11)
> Is the collapsed-sidebar thing an issue on the 1.7.x branch for seamonkey, though?

What shaver asked.  I probably want this for 1.4, too....

Comment 15

[Johnny Stenback (:jst)]

Oh, yes, sorry, forgot to update this bug. Seems like this *is* a problem for
sidebars in SeaMonkey. The remaining question then is, I guess, do we care?

Comment 16

[Tracy Walker [:tracy]]

Need the fix on seamonkey trunk for 1.8a5

Comment 17

[Asa Dotzler [:asa]]

Johnny, can you get this into the trunk for us, please?

Comment 18

[Johnny Stenback (:jst)]

Asa, I could land the patch in this bug, but it would kinda break sidebars. It
would make it such that the webpage that you're currently viewing won't be
reachable from a sidebar that's not currently displayed. Not all that big of a
deal I don't think, but it might break random sidebars, maybe. I don't know of a
easy fix for that problem... 

Comment 19

[Johnny Stenback (:jst)]

Fix landed on the trunk after discussion with Asa. If this breaks existing
sidebars we'll file new bugs on that and deal with those problems there.

Comment 20

[OstGote!]

(In reply to comment #19)
> Fix landed on the trunk after discussion with Asa. If this breaks existing
> sidebars we'll file new bugs on that and deal with those problems there.

I guess bug 271308 and bug 271314 are the first ones.

Comment 21

[Boris Zbarsky [:bzbarsky]]

Note that this is still around in a different guise -- see bug 273984