162585 - about:cache reveals the full profile path

Status: VERIFIED INVALID

(Core :: Networking: Cache, defect)

Description

[Darin Fisher]

from the cache security review notes:

  "about:cache contains profile directory path, so if attacker can read 
   about:cache they can find profile info. Should we worry about this, maybe
   mask the "salt" or something?"

marking this security sensitive to be conservative.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

If an attacker can read about:cache, they have already got a lot of sensitive
information about the user, so I don't think the fact that it reveals the
profile path is a serious issue. To be super-safe, we could stop displaying that
information, but we should weigh that against the usefulness of showing the
cache directory. I'm going to reassign this to the Cache component to get the
owners' opinions.

Comment 2

[Darin Fisher]

gordon and i agree that it's secure enough; if we discover further problems, we
can deal with them later.  it's important for the user to know the location of
their cache directory.

marking INVALID

Comment 3

[benc]

VERIFIED/invalid.