1654986 - Javascript Scheme Hrefs in Child Frames Execute in Parent Origin on Download

Status: RESOLVED FIXED

(Firefox for iOS :: General, defect)

Description

[Alison Huffman]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

Steps to reproduce:

Embed a page similar to the following in an iframe with differing origins.

<!DOCTYPE html>
<html>
<body>
<a href="javascript:alert(document.body.innerHTML)">Javascript URI</a>
</body>
</html>

If this link is long pressed and you press download it will execute the script in the context of the parent page and origin.

Actual results:

Javascript will run in the context of the parent origin / page.

Expected results:

Should either do nothing or run in the context of the child iframe.

Comment 1

[Tyson Smith [:tsmith]]

The reporter has reached out and requested this bug be considered for a bounty.

Comment 2

[Daniel Veditz [:dveditz]]

Garvan: why do we offer to download things that aren't http/https (or some restricted "allow" list, if we need to support local file: etc schemes)?

Comment 3

[:garvan]

The downloads feature is a pit of bugs yeah, we shouldn't offer to download anything other than http(s) and blob schemes.
Also seems very wrong that the iframe originates the request which then runs in the parent frame to perform the download, and not in the requesting iframe. That should also be fixed, or cross-frame downloads disabled for now if we can't fix it.

Comment 4

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:garvan, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 5

[:garvan]

https://github.com/mozilla-mobile/firefox-ios/pull/7289

Comment 6

[Alison Huffman]

Friendly ping was this ever resolved.

Comment 7

[Tyson Smith [:tsmith]]

Jeremy, is there someone available that can confirm this has been fixed, since :garvan's account is disabled?

Comment 8

[Jeremy Evans]

This issue was fixed by the above PR

Comment 9

[Daniel Veditz [:dveditz]]

I apologize for the long delay. We have awarded a bounty for this vulnerability. The severity is mitigated by the requirement that the victim site frame the malicious content, and the requirement for users to want to long-press to trigger the bug.