Closed Bug 1029243 Opened 10 years ago Closed 9 years ago

(shumway) Asterisk in token name should not be allowed

Categories

(Firefox Graveyard :: Shumway, defect)

Product:
Firefox Graveyard
Component:
Shumway
Version:
32 Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED INCOMPLETE

People

(Reporter: mwobensmith, Assigned: yury)

References

Details

(Whiteboard: [shumway])

Consider the case of content on http://foo.com accessing a site with this policy file: <cross-domain-policy> <allow-access-from domain="*foo.com" /> </cross-domain-policy> Expected: Should not load, because foo.com != *foo.com Actual: Data loads Policy file spec - see Appendix - Domain matching: http://www.senocular.com/pub/adobe/crossdomain/policyfiles.html
Blocks: 1029228
Whiteboard: [shumway]
Clarification: This pertains to content that loads data via flash.net.URLLoader, but likely affects all Flash data-loading APIs.
Till recommends that Yury look into these security issues.
Assignee: nobody → ydelendik
Product: Firefox → Firefox Graveyard
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.