127697 - nsDocShell::mValidateOrigin is never set

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Adam Lock]

I noticed a potentially serious problem while fixing up some scheme comparison
code in SameOrSubdomainOfTarget() in nsDocShell.cpp for bug 126432.

I have noticed that this code only gets called if mValidateOrigin is PR_TRUE but
it isn't. In fact mValidateOrigin never gets initialised at all!

Potentially, mValidateOrigin should be set in the nsDocShell constuctor by
reading the pref "browser.frame.validate_origin" but this pref does not exist so
presumably mValidateOrigin contains garbage.

So there is a security issue here. What should be done? My guess is that 
"browser.frame.validate_origin" should exist in all.js and mValidateOrigin
should default to PR_TRUE. Also if this code path has not been triggered for a
while it should be re-verified to ensure it is working properly.

Comment 1

[Adam Lock]

Patch in bug 126432 sets mValidateOrigin to PR_TRUE during construction

Comment 2

[Boris Zbarsky [:bzbarsky]]

This was fixed by the changes in bug 246923.