16672 - [DOGFOOD] JavaScript in HTML email message may read local files

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

There seems to be a security bug (or design flaw) in Mozilla 5.0 Messenger:
As [e-mail] explained me:
--------------------------------
When the body of the message
is encountered, a new temporary HTML file is written to disk and the following
line is added to the XUL document:

<html:iframe id="mail-body-frame" type="content-primary"
src="file:///C|/TEMP/nsMimeBody.html" border="0" scrolling="auto" resize="yes"
width="100%" flex="1"/>
-------------------------------
The problem is that the SRC of the IFRAME is the "file:" protocol. This means
that the JavaScript code in the body of the message (the IFRAME) has reading
access to all documents in the "file:" protocol.
This means that email message may read local files.

To demonstrate the problem, I suggest the following test case:
1) Create a file "c:\links.html" and put in it  an <A HREF=> tag, e.g. :
<A HREF="your text">link1</A>

2) Send HTML message to yourself which contains the following javascript code:
---
<SCRIPT>
s="file"+":///c|/links.html";
a=window.open(s);
setTimeout("alert(a.document.links[0].href)",5000);
</SCRIPT>
----
(I sent the message with Communicator 4.7)

3) Read the message with Mozilla 5.0 and the HREF of the <A> tag will be
displayed in an alert box in a few moments.

I tested that with build 1999101608.

Comment 1

[Norris Boyd]

*** Bug 16521 has been marked as a duplicate of this bug. ***

Comment 2

[Norris Boyd]

Travis says that it should be easier to fix the IFRAME src="file://..." after
the WebShell changes land.

Comment 3

[Norris Boyd]

Marking dogfood for analysis by PDT at jar's request.

Comment 4

[leger]

Putting on PDT+ radar.  But we believe that temp file is not longer being used,
thus this bug fixed.  rhp?

Comment 5

[rhp (gone)]

Sorry, the temp file still exists for the body of the message. When you are
displaying an email message, you are looking at a XUL document with the body
living in an IFRAME. Problem still relevant.

- rhp

Comment 6

[Norris Boyd]

Checking in mailnews/mime/emitters/src/nsMimeXULEmitter.cpp;
/m/pub/mozilla/mailnews/mime/emitters/src/nsMimeXULEmitter.cpp,v  <--  nsMimeXUL
Emitter.cpp
new revision: 1.47; previous revision: 1.46
done
Checking in mailnews/mime/emitters/src/nsMimeXULEmitter.h;
/m/pub/mozilla/mailnews/mime/emitters/src/nsMimeXULEmitter.h,v  <--  nsMimeXULEm
itter.h
new revision: 1.12; previous revision: 1.11
done

Comment 7

[leger]

Updating QA Contact.

Comment 8

[Paul Wyskoczka]

Marking verified per Norris's comments

Comment 9

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.