1464561 - Firefox Addressbar Spoofing using javascript URL Scheme

Status: RESOLVED DUPLICATE of bug 836567

(Firefox :: Address Bar, defect)

Description

[Jordi Chancel]

Attachment: testcase.html

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:60.0) Gecko/20100101 Firefox/60.0
Build ID: 20180516032328

Steps to reproduce:

The vulnerability is similar to Bug 1325955 (CVE-2017-5450) which was exploitable in Firefox for Android only.

This vulnerability is exploitable in Firefox Stable Update , Beta, and Nightly (PoC tested and works on Mac OS X El Capitan and Yosemite)

This address bar spoofing use a wrong URL Scheme (javascript: URL)

-1) Go to the uploaded testcase and click on the "spoof" button.


Actual results:

The Address Bar is spoofed with a wrong URL Scheme (javascript: URL).


Expected results:

Firefox should use a correct URL Scheme and display the correct domain used by the Proof of Concept.

Comment 1

[Daniel Veditz [:dveditz]]

No point in keeping hidden since bug 1325955 comment 4 is public and exposes this bug.

Comment 2

[:Gijs (he/him)]

We don't mis-highlight the URL (misleading the user), which is what the original bug was about. The location bar reflects the document's URL, which is indeed a javascript: one. The document's principal looks correct to me (inherited from the codebase principal of the attached testcase). So I think the address bar behaves correctly here.

Logically this means the bug needs moving or closing. I *think* this is effectively a dupe of bug 836567, in that the fix would need to be in core/dom/necko/JS land (not sure off-hand where jschannel lives) in terms of how we come up with a URI for a JS document, which would then also affect the URL displayed in the address bar.

Boris, can you sanity-check that diagnosis and mark as dupe if so? This is a bit in-at-the-deep-end for me after being away for retreat for 12 days. o.O

(Of course, we could also decide that we should make the address bar lie and not display the document URL, just like we've previously discussed showing the inherited domain for about:blank openings, x-ref bug 837791 and its un-duped dupes (I assume, given there's no discussion there but I'm *sure* we've discussed this before). But that feels like a somewhat larger change than fixing this underlying bug, and one that perhaps we should have some discussion with other vendors about (whereas the "actual" document URL issue is our bug per the spec, given bug 836567, I think?).

Comment 3

[Boris Zbarsky [:bzbarsky]]

Yep, this is a dup of bug 836567.  I really need to get back to that.