1141185 - Enforce Adobe's recommendation that Flash clickTAG URL parameters only use http:// or https://

Status: RESOLVED WONTFIX

(Core Graveyard :: Plug-ins, defect)

Description

[Chris Peterson [:cpeterson]]

Adobe recommends that ads verify that clickTAG URL parameters in HTML embed tags only use http:// or https://. Shumway should enforce this recommendation. In fact, Gecko could probably do this before loading Adobe's Flash plugin, too.

http://www.adobe.com/resources/richmedia/tracking/designers_guide/

This is an important security measure. If you do not take this precaution, a malicious HTML page could source your SWF and pass a clickTAG URL that begins with "javascript:" or another scripting pseudo-protocol. If your ActionScript code were to call getURL with a maliciously crafted JavaScript URL, it would be possible for the site serving the malicious HTML page to obtain the contents of your HTTP cookies or perform other actions on your site's behalf.

Comment 1

[Yury Delendik (:yury)]

Currently we whitelist targets used during "getURL" operation see https://github.com/mozilla/shumway/blob/master/extension/firefox/chrome/ShumwayCom.jsm#L460 to http and https only. We also apply allowScriptAccess policy there.

See also https://helpx.adobe.com/flash/kb/control-access-scripts-host-web.html

Comment 2

[Chris Peterson [:cpeterson]]

(In reply to Yury Delendik (:yury) from comment #1)
> Currently we whitelist targets used during "getURL" operation see
> https://github.com/mozilla/shumway/blob/master/extension/firefox/chrome/
> ShumwayCom.jsm#L460 to http and https only. We also apply allowScriptAccess
> policy there.

Does that mean this clickTAG policy is already implemented and we can close this bug?

Comment 3

[Yury Delendik (:yury)]

> Does that mean this clickTAG policy is already implemented and we can close
> this bug?

I think so, with exception of "In fact, Gecko could probably do this before loading Adobe's Flash plugin, too." recommendation in comment 0.

Comment 4

[Chris Peterson [:cpeterson]]

I'm moving this bug from Firefox::Shumway to Core::Plug-ins because Yury says Shumway effectively implements this already but that Gecko could do this by sanitizing clickTAGs before loading Adobe's Flash plugin too.

Comment 5

[Benjamin Smedberg]

I don't think we want to implement a Flash quirk for this, and if Flash already implements a check that should be sufficient.