1159136 - [Stingray][Smart-System] XSS/HTML injection in app modal dialog

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::TV::System, defect)

Description

[Sung Chiu[:sungchiu]]

Same issue in Bug 1158715. According to following link https://github.com/mozilla-b2g/gaia/blob/master/tv_apps/smart-system/js/app_modal_dialog.js#L310, where 'title' comes from app name in manifest, XSS injection may happen when others try to create a app name with escape characters.

Comment 1

[Muneaki Nishimura]

Thank you for sharing the progress to me.

As far as I looked at the same code there are several innerHTML in it that would be exploitable.
https://github.com/mozilla-b2g/gaia/blob/master/tv_apps/smart-system/js/app_modal_dialog.js#L330

And the similar code also exists in System app for handheld variants, it seems it may not be used from any apps at the moment.
https://github.com/mozilla-b2g/gaia/blob/master/apps/system/js/app_modal_dialog.js
Please check them as well.

Comment 2

[Sung Chiu[:sungchiu]]

Attachment: Pull Request

1. Change innerHTML to textContent in app_modal_dialog in order to prevent potential XSS injection.

Comment 3

[John Hu [:johnhu][:johu][:醬糊小弟]]

Comment on attachment 8599645 [details] [review]
Pull Request

Looks good to me. But please remove escapeHTML code.

Comment 4

[John Hu [:johnhu][:johu][:醬糊小弟]]

Hi Muneaki,

May you file another bugs for apps/system app? Although smart-system is a special fork of system app, we had done some modifications. The patch of those two may be different. According to our understanding, bug 1159136 and bug 1159137 affected both system apps.

(In reply to Muneaki Nishimura from comment #1)
> Thank you for sharing the progress to me.
> 
> As far as I looked at the same code there are several innerHTML in it that
> would be exploitable.
> https://github.com/mozilla-b2g/gaia/blob/master/tv_apps/smart-system/js/
> app_modal_dialog.js#L330
> 
> And the similar code also exists in System app for handheld variants, it
> seems it may not be used from any apps at the moment.
> https://github.com/mozilla-b2g/gaia/blob/master/apps/system/js/
> app_modal_dialog.js
> Please check them as well.

Comment 5

[Muneaki Nishimura]

(In reply to John Hu [:johnhu][:johu][:醬糊小弟] from comment #4)
> Hi Muneaki,
> 
> May you file another bugs for apps/system app? Although smart-system is a
> special fork of system app, we had done some modifications. The patch of
> those two may be different. According to our understanding, bug 1159136 and
> bug 1159137 affected both system apps.
> 
> (In reply to Muneaki Nishimura from comment #1)
> > Thank you for sharing the progress to me.
> > 
> > As far as I looked at the same code there are several innerHTML in it that
> > would be exploitable.
> > https://github.com/mozilla-b2g/gaia/blob/master/tv_apps/smart-system/js/
> > app_modal_dialog.js#L330
> > 
> > And the similar code also exists in System app for handheld variants, it
> > seems it may not be used from any apps at the moment.
> > https://github.com/mozilla-b2g/gaia/blob/master/apps/system/js/
> > app_modal_dialog.js
> > Please check them as well.

OK, I filed a new bug 1160069 for requesting to reflect following two changes to System app.
https://github.com/mozilla-b2g/gaia/pull/29786
https://github.com/mozilla-b2g/gaia/pull/29811

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Master: https://github.com/mozilla-b2g/gaia/commit/9143008f97f47fe76fd44cd1189314dcc7955a17

Comment 7

[Ryan VanderMeulen [:RyanVM]]

v2.2: https://github.com/mozilla-b2g/gaia/commit/37a1e7bb6d943eed108c4cdf85915694a14b572a