1771774 - (CVE-2022-36318) Directory indices plaintext serialization (nsDirectoryIndexStream) shouldn't just echo all URL input

Status: VERIFIED FIXED

(Core :: Networking, defect, P2)

Description

[:Gijs (he/him)]

Like bug 1488061 but for the plaintext serialization code in nsDirectoryIndexStream.cpp. Quoting myself from elsewhere:

As noted in my last comments in bug 1460538, the change in bug 1488061 then also didn't work because it changes the HTML output but not the indexed stream - to fix things that way we need to change https://searchfox.org/mozilla-central/rev/8f42809e51cb07aa4f5739932a06d14581e9dd4a/netwerk/base/nsDirectoryIndexStream.cpp#100,102-103 to strip query params for file and/or jar and/or chrome (or rather, only include it for... well, for what, exactly?)

Comment 1

[:Gijs (he/him)]

Attachment: Bug 1771774, r?kershaw

Comment 2

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

r=kershaw
https://hg.mozilla.org/integration/autoland/rev/c86aadc5909ca5fbf081cd53ca7f5c3ddeb29568
https://hg.mozilla.org/mozilla-central/rev/c86aadc5909c

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:Gijs, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
• If no, please set status-firefox103 to wontfix.

For more information, please visit auto_nag documentation.

Comment 4

[:Gijs (he/him)]

Comment on attachment 9283180 [details]
Bug 1771774, r?kershaw

Beta/Release Uplift Approval Request

• User impact if declined: Potential for further security impact
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: 1. open chrome://browser/content/places/?foo

2. hit view source (ctrl/cmd-u)
3. check the first line. It should not include the "?foo" part

(Note: unsure if you can easily test this on android as you can't 'view source'... you can try sticking view-source: in front of the URL in the address bar to accomplish that part but if that doesn't work I would just not bother verifying on android - this code is x-platform so verifying on desktop should be sufficient.)

• List of other uplifts needed: n/a
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Pretty small changes to non-critical bits of code
• String changes made/needed: N/A
• Is Android affected?: Yes

Comment 5

[Donal Meehan [:dmeehan]]

Comment on attachment 9283180 [details]
Bug 1771774, r?kershaw

Approved for 103.0b8, thanks.

Comment 6

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-beta/rev/c983632946c0

Comment 7

[Ryan VanderMeulen [:RyanVM]]

This grafts cleanly to ESR102/ESR91. Did you want to nominate for uplift to those as well?

Comment 8

[:Gijs (he/him)]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #7)

This grafts cleanly to ESR102/ESR91. Did you want to nominate for uplift to those as well?

Suuuuureeee..

Comment 9

[:Gijs (he/him)]

Comment on attachment 9283180 [details]
Bug 1771774, r?kershaw

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: sec-moderate / vector
• User impact if declined: Potential for injection attacks in various places
• Fix Landed on Version: 104
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Pretty small changes to non-critical bits of code

Comment 10

[Daniel Bodea [:danibodea]]

I have reproduced the original issue in Nightly from 2022-06-15 ("?foo" appears in the first row of the page source page) and confirmed the fix in Nightly 104.0a1 from 2022-07-13 and Beta v103.0b8 on Windows 10, Ubuntu 22 (wayland and xwayland) and Mac OS 11 (the "?foo" is no longer displayed in the page source).

Comment 11

[Donal Meehan [:dmeehan]]

Comment on attachment 9283180 [details]
Bug 1771774, r?kershaw

Approved for ESR91.12 and ESR102.1, thanks.

Comment 12

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/2f6ff5dba74d

Comment 13

[Donal Meehan [:dmeehan]]

https://hg.mozilla.org/releases/mozilla-esr102/rev/a2adccae05a4

Comment 14

[Daniel Bodea [:danibodea]]

Fix also verified in ESR91 unreleased build v91.10.0esr with ID 20220714125707 and ESR102 unreleased build v102.1.0esr with ID 20220714135928 on Windows 10 and Ubuntu 22.

Comment 15

[Frederik Braun [:freddy]]

Attachment: advisory.txt