177650 - Should we disable XBL loading from style attribute?

Status: VERIFIED INVALID

(Core :: XBL, defect)

Description

[bsharma]

This issue was reported after the Security review of XBL, jag asked me to make a
bug out of the issue.

Comment 1

[timeless]

do you have an alternative? our entire chrome system relies on this.

Comment 2

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Stylesheet processing instructions and inside style tags? Do we really use/need
style _attributes_ to load XBL?

Comment 3

[David Hyatt]

Huh? Why would you disable XBL loading via the style attribute?  This is ridiculous.

Comment 4

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Loading XBL via style attributes introduces one more code path that needs
careful handling from security perspective. The more of these entry points we
have, the more likely it is we will make a mistake somewhere. 

If a feature is not necessary, and can easily be done some other way, we should
at least think of the issues at hand before throwing "it's ridiculous" arguments
without any thoughts to the issues.

Nobody is saying at this point that we should definitely disable XBL from style
attributes. But we do want to evaluate the pros and cons.

Comment 5

[David Hyatt]

style attributes use the same CSS code as everyone else.  I don't see what you
mean here.  If you want to worry about XBL's loading policy, e.g., what types of
URLs can load what other types of URLs, that's a valid concern, but why single
out the style attribute?  Loading a binding via the style attribute is no
different from using an author sheet with an XBL rule.  Maybe I'm confused and
you really meant this bug should be examining author loading of XBL period?

Anyway, XBL follows all of the same URL loading checks that everyone else does
for whether or not it's allowed to be loaded.

Comment 6

[Hixie (not reading bugmail)]

VERIFIED. There's nothing special about the style attribute here.

Comment 7

[Heikki Toivonen (remove -bugzilla when emailing directly)]

I think we found style attribute strange because typically you do very minimal
tweaks with them, like color some element different. Loading external files from
there seems to go against that principle, and people might not realize it is
possible which could provide unwelcome surprises. The actual code to load XBL is
in one place, but this is just one more way to get there.

Comment 8

[Hixie (not reading bugmail)]

background: url(foo.swf)

...also loads external code (and that we don't support it is a bug not a feature).