336519 - Show Only This Frame XSS (SeaMonkey)

Status: RESOLVED FIXED

(SeaMonkey :: Security, defect)

Description

[Daniel Veditz [:dveditz]]

SeaMonkey-tracking pointer to bug 329468 -- see discussion and patches in that bug. This is a placeholder to allow me to set appropriate release flags since it is now no longer possible to have both Firefox and SeaMonkey blocking flags on the same bug, even a core bug.

Comment 1

[Daniel Veditz [:dveditz]]

Presumptively marking blocking for sm1.0.2 so this doesn't drop off the radar when I close the other bug.

Comment 2

[[e-mail]]

Attachment: Original patch

From bug 329468, but with case-insensitive regexp so as to correctly match any URIs which might be javascript or data.

Comment 3

[[e-mail]]

Geez, now bugzilla silently removes the requestee if they're not CC'd :-(

Comment 4

[[e-mail]]

Attachment: With fixup

Because jag asked for it (although I fail to see why it's necessary).

Comment 5

[[e-mail]]

Comment on attachment 257157 [details] [diff] [review]
With fixup

>-        window.loadURI(this.target.ownerDocument.location.href);
>+        openTopWin( this.bgImageURL, this.target.ownerDocument.defaultView );
Whoops. Copy & paste error :-[

Comment 6

[[e-mail]]

Comment on attachment 257156 [details] [diff] [review]
Original patch

Fixing review flags here too.

Comment 7

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 257157 [details] [diff] [review]
With fixup

whichever version you check in, please fix that copy/paste error :)

Comment 8

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 257157 [details] [diff] [review]
With fixup

actually... you should probably pass 0 as flags, like docshell:
http://lxr.mozilla.org/seamonkey/source/docshell/base/nsDocShell.cpp#2760

Otherwise, a string "foo" would become "http://www.foo.com". while this may make no difference here, it still seems better to do the same as docshell (docshell only passes the alternate URI flag when the load failed)

Comment 9

[[e-mail]]

Attachment: Addressed biesi's comments

* Fixed copy/paste error in previous patches
* Changed to use FIXUP_FLAG_NONE
* Changed to focus the content window

Comment 10

[jag (Peter Annema)]

Comment on attachment 278232 [details] [diff] [review]
Addressed biesi's comments

+    var uriFixup = Components.classes["@mozilla.org/docshell/urifixup;1"]
+                            .getService(nsIURIFixup);

Nit: indentation, just fix that before checking in.

Comment 11

[Robert Kaiser]

Neil, has this landed anywhere yet?

Comment 12

[[e-mail]]

(In reply to comment #11)
> Neil, has this landed anywhere yet?
It landed on CVS trunk.

Comment 13

[Robert Kaiser]

Neil, from what I see, with that EOLing of SeaMonkey 1.x, can we mark this one FIXED as having landed on cvs trunk should mean it's also fixed in both comm-1.9.1 and comm-central, right?

Comment 14

[Robert Kaiser]

Comment on attachment 278232 [details] [diff] [review]
Addressed biesi's comments

1.x has been EOLed, so canceling 1.1.5 approval request. Looks like I didn't see that one back then. :(

Comment 15

[[e-mail]]

Marking as fixed for 2.0 (well 1.5 really!)