1138055 - Review Shumway's name resolution to ensure content can't access arbitrary properties on arbitrary objects

Status: RESOLVED INCOMPLETE

(Firefox Graveyard :: Shumway, defect)

Description

[Till Schneidereit [:till]]

All names in AS3 are namespaced. Shumway implements this using a name-mangling scheme. In the interpreter, all name lookups happen through a direct implementation of the name resolution algorithm that Tamarin uses, too. In the JIT compiler, statically-known names are sometimes resolved during compilation and the lookup is done with the mangled name as a normal JS name lookup.

Since the runtime itself and all our builtins run in the same compartment, any escape from this name mangling, i.e. any way that content can access non-mangled names, would mean that we've probably lost all sandbox protection inside the compartment. That in itself isn't truly fatal as the content would still need to circumvent our other two layers of sandboxing to gain chrome privileges. It would, however, mean that our SecurityDomain implementation could be circumvented, so content from a SWF from one domain could freely access the innards of a SWF from another domain loaded into the same player instance.

mbx is currently reworking much of this, so it wouldn't make sense to review the current state, but that should change soon-ish.