313724 - Scripts can nullify explicit local roots by setting caller.arguments[n]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Some explicit local roots are available to scripts through caller.arguments[n] (see bug 313370 comment 8).  Furthermore, scripts can modify caller.arguments[n], nullifying such a local root.  The resulting lack of a local root creates the potential for a security hole (see bug 311497 comment 10).

Comment 1

[Jesse Ruderman]

Attachment: brendan's patch

"Prevent setting args of natives (natives are what use local roots)"

Checked into trunk and MOZILLA_1_8_BRANCH half an hour ago.  This is the MOZILLA_1_8_BRANCH version of the patch.

Comment 2

[Bob Clary [:bc] (inactive)]

needs to go in the "security" suite, not the js test library.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: backported for the 1.7 branch

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 211457 [details] [diff] [review]
backported for the 1.7 branch

r=me, didn't seem hard ;-).

/be

Comment 5

[Tim Riley [:timr]]

Comment on attachment 211457 [details] [diff] [review]
backported for the 1.7 branch

a=timr for drivers

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Fixed version of the patch checked into the 1.7 branches.

Comment 7

[Marcia Knous [:marcia]]

QA could use some help with the best way to verify this bug for 1.0.8. Thanks.

Comment 8

[Marcia Knous [:marcia]]

Jesse mentioned that we don't have a test case for this and he wasn't certain how to put one together, so doubtful QA can verify this bug.

(In reply to comment #7)
> QA could use some help with the best way to verify this bug for 1.0.8. Thanks.
>