176774 - XML-RPC needs to listen to redirects

Status: RESOLVED FIXED

(Core :: XML, defect)

Description

[Heikki Toivonen (remove -bugzilla when emailing directly)]

XML-RPC tries to limit itself to http and https protocols, but this can be
subverted by doing a server side redirect. To prevent this, XML-RPC needs to
listen to redirects. Implement nsIHttpEventSink, and in onRedirect check the
scheme again, blocking redirects to non http(s) URLs.

You can look at XMLHttpRequest implementation on how it did this.

Also, if you don't do it already, you should implement auth prompt in case the
connection requires login & password. See method
nsXMLHttpRequest::GetInterface() for a sample. One caveat, see bug 176051 (btw,
Darin, I might need some help there).

Comment 1

[Darin Fisher]

nsIAuthPrompt is implemented, but i wanted add one more comment.  if you have a
same origin policy for xml-rpc requests, then you need to make sure that a HTTP
redirect doesn't subvert that policy.

Comment 2

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Can XML-RPC be used from Web pages? Are we shipping it by default? (It looks
like it's built by default.)

Comment 3

[Heikki Toivonen (remove -bugzilla when emailing directly)]

It can't be used by web pages (except by signed script). We build and ship it by
default.

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

Not a blocker since this can't be used by untrusted content.

Comment 5

[chris hofmann]

removing  sg:mustfix

Comment 6

[Samuel Sieb]

xml-rpc will be using XMLHttpRequest as per bug 197087.  That will handle the redirects safely and resolve this bug, right?

Comment 7

[Samuel Sieb]

fixed by bug 197087