1295002 - (CVE-2017-5422) Recursive keyword fixup for many-nested view-source: URLs crashes

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Alex B]

Attachment: example.html

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Build ID: 20160726073904

Steps to reproduce:

Lots of view-source: strung together cause the browser to crash.


Actual results:

The browser crashed.


Expected results:

Viewing the source of view-source is pointless & should be blocked.

Comment 1

[Andre Klapper]

Thanks for taking the time to report this!
Please provide the crash ID from about:crashes : https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report explains how to do this. When doing so, please also add the keyword "crashreportid" to the "Keywords" field of this report.

Comment 2

[Robert Longson [:longsonr]]

bp-68bc2ca0-5bce-44d3-a1c0-839af2160814

Comment 3

[Kanchan Kumari QA]

I tried reproducing this issue and got crash: bp-8e3b0f7f-1c64-450a-8478-62d842160817

User Agent 	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:48.0) Gecko/20100101 Firefox/48.0

Comment 4

[:Gijs (out for now; he/him)]

Attachment: Bug 1295002 - don't accept nested view-source: references in nsDefaultURIFixup,

This seems like much the simplest way to prevent the recursion. Other alternatives
include some kind of member var to track state (which wouldn't be threadsafe, though
I don't know that that really matters for this component) or adding a field on
nsIDefaultURIFixupInfo, which seems ugly. This is a bit hacky, but it seems to work.

Review commit: https://reviewboard.mozilla.org/r/82606/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/82606/

Comment 5

[Andrea Marchesini [:baku]]

Comment on attachment 8796980 [details]
Bug 1295002 - don't accept nested view-source: references in nsDefaultURIFixup,

I'm not docshell peer.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8796980 [details]
Bug 1295002 - don't accept nested view-source: references in nsDefaultURIFixup,

https://reviewboard.mozilla.org/r/82606/#review81338

I guess we can do this. Stipping view-source in a loop might be a bit nicer, but shouldn't really matter.

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8796980 [details]
Bug 1295002 - don't accept nested view-source: references in nsDefaultURIFixup,

https://reviewboard.mozilla.org/r/82606/#review81338

Er, stripping

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b7ccf1f2df8f
don't accept nested view-source: references in nsDefaultURIFixup, r=smaug

Comment 9

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/b7ccf1f2df8f