13312 - Spoofing windows using document.write()

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[joro]

There is a possibility for spoofing windows in in Mozilla 5.0 build 1999090408
(later builds crash at startup on my computer) using document.write().
The code is:

a=window.open("http://www.yahoo.com","a");
setTimeout("a.document.open();a.document.write('This window is
spoofed');a.document.close();",20000);

Comment 1

[Mike Shaver (:shaver emeritus)]

We can't ship final with this, but I think a proper fix depends on 9111.  What
if we just clear the URL bar when we do a document.open?

Comment 2

[Mike Shaver (:shaver emeritus)]

This is going to wait until M15, unless someone yells really loudly.  (Hint: the
loudest yelling is that which includes a patch. =) )

Comment 3

[Norris Boyd]

I think spoofing is okay for beta. I'd rather not, but we're pushing hard to get
other, more serious security problems resolved.

Comment 4

[vidur (gone)]

In an attempt to get my bug list in order again, marking all the bugs I have
currently as ASSIGNED.

Comment 5

[joro]

I consider this bug fixed. It gives a security error.

Comment 6

[John Unruh]

What happens now is that a second window is opened, showing yahoo in the 
location bar and in the content. Is this the expected behavior?

Comment 7

[joro]

Mozilla behaves as expected. The bug is fixed.

Comment 8

[Johnny Stenback (:jst)]

I don't see any problems here any more either (I get the security warning), if
someone else disagrees then please reopen. Marking fixed.

Comment 9

[John Unruh]

Verified fixed.