166650 - SetHTMLAttribute needs security checks like SetAttribute

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect, P2)

Description

[John Keiser (jkeiser)]

From the forms security review.  There is no known exploit for this, but
SetHTMLAttribute does not do the same SetValue security checks as SetAttribute.
 We should probably do the same thing there to protect against things.

Discussion needed; is this worth it?

Comment 1

[Johnny Stenback (:jst)]

SetHTMLAttribute() is not callable from script w/o going through SetAttribute(),
so I don't see us needeing to duplicate the security check in SetHTMLAttribute()...

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

IF there is no issue here, please close the bug.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Let's put a comment in the code to make sure this never becomes a problem. Then
we'll mark this fixed. John, can you add the warning?

Comment 4

[Mitchell Stoltz (not reading bugmail)]

peterv, can you please add a comment in this code?

Comment 5

[Peter Van der Beken [:peterv]]

Sure, so where exactly is the security check in SetAttribute that I should be
referring too?

Comment 6

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

iirc this was about setting the value-attribute on an <input type=file>

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Fixed with the checkin of bug 232016 since the function doesn't exist any more,
and thus all callers of it now pass through the existing security mechanisms.