11527 - Plain Text Editor allows reading text and parsed HTML files

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

There is a security vulnerability in Mozilla 5.0 M8 (later builds are also
affected)
which allows reading local text and parsed HTML files using the Plain Text
Editor.
The idea is opening the editor, selecting all the text and accessing the
selected text.

In downloaded TextEditorAppShell.xul is added:
function DumpFile()
{
 EditorSelectAll();
 dump("-----Begin C:\\TEST.TXT\n");
 dump(editorShell.editorSelection.getRangeAt(0).toString());
 dump("\n-----End C:\\TEST.TXT\n");
}
setTimeout("DumpFile()",5000)

Demonstration is available at:
http://www.nat.bg/~joro/mozilla/editor/editor.html

Comment 1

[Norris Boyd]

Move security bugs from M11 to M13; needed for beta but not for dogfood.

Comment 2

[Norris Boyd]

XPAppCoresManager finally died, closing this security hole.

Comment 3

[John Unruh]

Verified fixed.

Comment 4

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fb66f5cf42e1
[components] For https://github.com/mozilla-mobile/android-components/issues/11527 - Allow the decor view time to process the incoming insets