1735265 - (CVE-2022-28286) Firefox incorrectly draws outside of iframe.

Status: VERIFIED FIXED

(Core :: Web Painting, defect, P1)

Description

[prada960808]

Attachment: parent.html

User Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36

Steps to reproduce:

1. open 'parent.html' on Firefox 93.
2. load 'child.html' by executing Js code
   set_frame('./child.html');

Actual results:

The content in iframe is drawn outside of iframe even if 'child.html' is loaded from a local server.

Expected results:

The content in iframe should not be drawn outside of iframe.

Comment 1

[prada960808]

Attachment: child.html

Comment 2

[prada960808]

Attachment: ref_image.png

Comment 3

[Alice0775 White]

Attachment: test.html

Comment 4

[Alice0775 White]

I can reproduce the issue in Nightly95.0a1 Windows10.

Regression window:
https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=45f6157a879ec5e6435a068bb7825169bd01c9a9&tochange=ceaebebccb5e67929ed7ba66d60954a9f218dc26

Comment 5

[Emilio Cobos Álvarez (:emilio)]

A layout change caused this but this is a graphics/displaylist issue afaict. Miko, any chance you could take a look?

Comment 6

[prada960808]

Is this a security issue?
It seems this can cover the content of the main frame from the iframe so that the user cannot see the website properly.

Comment 7

[Miko Mynttinen]

Looking into this.

Comment 8

[Miko Mynttinen]

Attachment: parent.html

Comment 9

[Miko Mynttinen]

Attachment: child.html

Comment 10

[Miko Mynttinen]

Attached simplified testcases.

It seems that <colgroup> creates a table width sized background item that extends beyond the body bounds when the overflow is hidden. This seems to only happen when the corresponding <th> element has a stacking context or layer inducing style such as filter or will-change: transform (but surprisingly opacity does not work).

Comment 11

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:mattwoodrow, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 12

[Miko Mynttinen]

Attachment: dl.txt

Display list dump.

It seems that TableBackgroundColor item ends up outside of the transform item, despite having will-change: transform set.

Comment 13

[Miko Mynttinen]

Attachment: Bug 1735265 - Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange

Comment 14

[Miko Mynttinen]

Attachment: Bug 1735265 - Part 2: Add test r=mstange

Depends on D129681

Comment 15

[Daniel Veditz [:dveditz]]

The reporter requested that we consider this issue for the security bug bounty.

What are the limits or restrictions on what can be drawn on the framing page?

Comment 16

[Miko Mynttinen]

(In reply to Daniel Veditz [:dveditz] from comment #15)

The reporter requested that we consider this issue for the security bug bounty.

What are the limits or restrictions on what can be drawn on the framing page?

Consider a parent document with an iframe pointing to a child document that contains a table.
When a table header cell has stacking context inducing properties, its colum and column group backgrounds might be incorrectly clipped. If the table is large enough, these backgrounds can cover elements outside of the parent documents iframe bounds.

I was able to construct a testcase that fully covers the parent document in red. Browser chrome is unaffected.

Comment 17

[Daniel Veditz [:dveditz]]

I assume a background image could be used as well? That makes the possibilities more interesting, but as an attack you'd still have to get your potential victim to frame you, and then hope there was something critical you could "erase" by covering it up or "replace" with an image that somehow fooled the viewer into interpreting things differently.

Comment 18

[prada960808]

When CSS background-image is used in element "colgroup", you can cover and replace the web contents with the image.
You can also place that image by applying the CSS width, height, left and top to the table element.

Comment 19

[prada960808]

Attachment: poc.html

Comment 20

[Miko Mynttinen]

Comment on attachment 9248040 [details]
Bug 1735265 - Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange

Security Approval Request

• How easily could an exploit be constructed based on the patch?: Not easily, it would require knowledge of how Gecko handles clipping and table backgrounds.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which older supported branches are affected by this flaw?: All
• If not all supported branches, which bug introduced the flaw?: None
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: The code changed in the patch was recently (FF92) moved to a different file, but the fix would be the same.
• How likely is this patch to cause regressions; how much testing does it need?: Unlikely to cause regressions.

Comment 21

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Comment on attachment 9248040 [details]
Bug 1735265 - Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange

sec-low does not require sec-approval, you can land the patch and test as normal.

Comment 22

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Landed:
https://hg.mozilla.org/integration/autoland/rev/c897d241ad396ac945043b026aca252defbe4704
https://hg.mozilla.org/integration/autoland/rev/26205128ce346e3b118df5e5610cec0c5aa30a05

Backed out for causing reftest failures with 1735265-2-ref.html:

https://hg.mozilla.org/integration/autoland/rev/47deea61c5ca3fa3bbfc00673b091cfd3c0ffd14

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&group_state=expanded&selectedTaskRun=V99XSHzxRbmkvlt3ff4izg.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cusercancel&revision=26205128ce346e3b118df5e5610cec0c5aa30a05
Reftest analyzer (width is smaller than in reference): https://hg.mozilla.org/mozilla-central/raw-file/tip/layout/tools/reftest/reftest-analyzer.xhtml#logurl=https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/V99XSHzxRbmkvlt3ff4izg/runs/0/artifacts/public/logs/live_backing.log&only_show_unexpected=1

Comment 23

[BugBot [:suhaib / :marco/ :calixte]]

There are some r+ patches which didn't land and no activity in this bug for 2 weeks.
:miko, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 24

[Miko Mynttinen]

I think this was originally regressed by bug 1409114.

Comment 25

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1409114

Comment 26

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange
https://hg.mozilla.org/integration/autoland/rev/0e8ecb27701d1a671925d48bacaa206670c30a79
https://hg.mozilla.org/mozilla-central/rev/0e8ecb27701d

Part 2: Add test r=mstange
https://hg.mozilla.org/integration/autoland/rev/2371151dc9e98b077620490bcb70785adcac68bd
https://hg.mozilla.org/mozilla-central/rev/2371151dc9e9

Comment 27

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for Beta/ESR approval when you get a chance.

Comment 28

[BugBot [:suhaib / :marco/ :calixte]]

Changing the priority to P1 as the bug is tracked by a release manager for the current beta.
See Triage for Bugzilla for more information.
If you disagree, please discuss with a release manager.

Comment 29

[Miko Mynttinen]

Comment on attachment 9248040 [details]
Bug 1735265 - Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange

Beta/Release Uplift Approval Request

• User impact if declined: Table cell contents can overflow table bounds
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patch is simple and includes a test. Additionally, this table structure is probably relatively rare.
• String changes made/needed:

Comment 30

[Donal Meehan [:dmeehan]]

Comment on attachment 9248040 [details]
Bug 1735265 - Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange

Approved for 99.0b8. Thanks.

Comment 31

[Donal Meehan [:dmeehan]]

Comment on attachment 9248041 [details]
Bug 1735265 - Part 2: Add test r=mstange

Approved for 99.0b8. Thanks.

Comment 32

[Donal Meehan [:dmeehan]]

Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange
https://hg.mozilla.org/releases/mozilla-beta/rev/e3a76df996b6
Part 2: Add test r=mstange
https://hg.mozilla.org/releases/mozilla-beta/rev/97b3e77ec5a7

Comment 33

[Ryan VanderMeulen [:RyanVM]]

Do we want this on ESR also?

Comment 34

[Miko Mynttinen]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #33)

Do we want this on ESR also?

I cannot comment about the security implications, but I think this is quite safe to uplift.

Comment 35

[Miko Mynttinen]

Comment on attachment 9248040 [details]
Bug 1735265 - Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Low risk patch that fixes a sec-low issue.
• User impact if declined: Table cell contents can overflow table bounds. Probably not a common issue in normal web content but has some security implications.
• Fix Landed on Version: 100
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patch is simple and includes a test.

Comment 36

[Raluca Popovici, Desktop QA]

I was able to reproduce this issue on my machine Win 10x64 on Nightly 95.0a1. I confirm the fix on Firefox 99.0b8 and Nightly 100.0a1

Comment 37

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9248040 [details]
Bug 1735265 - Part 1: Set clip on background items for table cols and colgroups, when the table cell has captured clip r=mstange

Thanks for the verification. Approved for 91.8esr.

Comment 38

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/aa53a3f7fa51
https://hg.mozilla.org/releases/mozilla-esr91/rev/333794dc5892

Comment 39

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: advisory.txt

Comment 40

[Raluca Popovici, Desktop QA]

Verified fixed on Fx 91.8esr on Win 10x64. Reproduced on 91.6.1esr.