10194 - Possible security vulnerability in "chrome:" protocol - accessing local files using "chrome://global/skin/../"

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

The "chrome:" protocol allows accessing local files outside the mozilla
directory.
The problems are URLs like "chrome://global/skin/../", where ".." references the
parent directory (I guess this is not desired behaviour).
Communicator 4.x had similar problems with the "wysiwyg:" protocol.
Sample link is:

<A HREF="chrome://global/skin/../../../../autoexec.bat">
autoexec.bat - chrome://global/skin/../../../../autoexec.bat
</A>

Demonstration is available at:
http://www.nat.bg/~joro/mozilla/chrome1.html

Comment 1

[Norris Boyd]

We need to prohibit creation of chrome: urls from web JavaScript.

This example now gets an error from the Chrome registry, but we need to have an
explicit security check.

Comment 2

[Norris Boyd]

Move security bugs from M11 to M13; needed for beta but not for dogfood.

Comment 3

[Norris Boyd]

Fixed:

Checking in nsChromeRegistry.cpp;
/m/pub/mozilla/rdf/chrome/src/nsChromeRegistry.cpp,v  <--  nsChromeRegistry.cpp
new revision: 1.75; previous revision: 1.74
done

Comment 4

[John Unruh]

Verified fixed.

Comment 5

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.