162584 - verify proper HTML escaping in about:cache

Status: RESOLVED FIXED

(Core :: Networking: Cache, defect)

Description

[Darin Fisher]

verify proper HTML escaping in about:cache.

from the cache security review notes:

  "We URL escape the URLs we show in about:cache so <script> as part of URL is
   not a problem. What about other fields in about:cache? We should also check
   all fields if they are printable, and not try to show fields that aren't."

Comment 1

[Robert O'Callahan (:roc) (email my personal email if necessary)]

           Key: http://adserver.theonering.net/images/orclegion_468x60.gif
     Data size: 16820 Bytes
   Fetch count: 1
 Last Modified: Tue 15 Oct 2002 10:44:29 AM EDT
       Expires: Thu 14 Nov 2002 09:44:29 AM EST

You say that Key is already escaped. The other fields don't need to be escaped.
Am I missing something or can this bug be closed?

Comment 2

[Darin Fisher]

about:cache-entry is the more interesting case, because it shows HTTP headers. 
anyways, i think this is probably invalid because about:cache* does not have
chrome privileges.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Even if it doesn't have chrome privileges, we should still double-check that all
the right escaping is happening. I'll do it.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

We seem to be escaping in all the right places, except that we might want to not
linkify keys if they are javascript: or data: URLs. Gordon tells me that
javascript: and data: URLs are not currently used as cache keys, but for
safety's sake I think we should check for them so that this problem never
arises. Darin, what do you think? Is it worth checking for data: and javascript:
URLs in about:cache-entry?

Comment 5

[Darin Fisher]

i can't think of a path that would cause javascript: and data: URLs to end up as
cache keys, although cache keys are not necessarily URLs.  they are raw binary
data completely defined by the cache clients, so it is completely possible that
someone could (one day) use such strings as cache keys.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch - don't linkify javascript: and data: cache keys

Darin, Gordon, how do you feel about checking for javascript: and data: URLs,
just in case they're ever used as cache keys?

Comment 7

[Darin Fisher]

Comment on attachment 108561 [details] [diff] [review]
Patch - don't linkify javascript: and data: cache keys

seems good, but can you through in a comment about why this is being done. 
maybe reference this bug. thx!

Comment 8

[gordon]

Comment on attachment 108561 [details] [diff] [review]
Patch - don't linkify javascript: and data: cache keys

Great, thanks. r=gordon

Comment 9

[Mitchell Stoltz (not reading bugmail)]

Fix checked in.

Comment 10

[Mitchell Stoltz (not reading bugmail)]

adding [e-mail] to CC list