343175 - PopupBlocker XSS

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[shutdown]

Blocked popups requested by subframes inherit the security context from
the top-level document when showing them. This causes some troubles if
the top-level document and subframes are served from different domains.

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/dom/src/base/nsGlobalWindow.cpp&rev=1.863&mark=4206-4209,4216,4218-4220,4258#4200
http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/browser/base/content/browser.js&rev=1.654&mark=542-546,555-566#540

Comment 1

[shutdown]

Attachment: testcase

this testcase is depending on bug 343168 to make up a mixed document.
popupblocker needs to be enabled. works on:

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1a3)
  Gecko/20060629 BonEcho/2.0a3
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.0.5)
  Gecko/20060629 Firefox/1.5.0.5

Comment 2

[Boris Zbarsky [:bzbarsky]]

Hmm...  I'm not sure why we use the top window, here, exactly.  Are there some sort of reasons the popup blocker UI needs that data?  If so, we should be passing more data around, sounds like.

Comment 3

[timeless]

at cenzic we used all the information from the popupblocked event and more in order to get work done. please contact colin before breaking this too badly.

Comment 4

[Boris Zbarsky [:bzbarsky]]

timeless, my point was that if the popup blocker needs the originating window, then that window should be a member of the popup blocked event...

Comment 5

[Johnny Stenback (:jst)]

Attachment: Fix. Make the requesting URI be that of the window on which open() was called.

Comment 6

[Johnny Stenback (:jst)]

Fix checked in.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 229581 [details] [diff] [review]
Fix. Make the requesting URI be that of the window on which open() was called.

a=dbaron on behalf of drivers.  Please check in to MOZILLA_1_8_BRANCH and mark
fixed1.8.1 once you have.

(Did the reviewers mention NS_STATIC_CAST?)

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 229581 [details] [diff] [review]
Fix. Make the requesting URI be that of the window on which open() was called.

approved for 1.8.0 branch, a=dveditz for drivers

Comment 9

[Johnny Stenback (:jst)]

Fixed on the 1.8.0 branch.

Comment 10

[Jay Patel [:jay]]

v.fixed on both branches:
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.7) Gecko/20060906 Firefox/1.5.0.7
Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1b2) Gecko/20060907 BonEcho/2.0b2

Comment 11

[Alexander Sack]

interestingly, the behaviour on 1.0.x is upside-down. With the patch I get bugzilla cookies displayed, without the patch, something else.