182176 - ".." exploit in chrome registry using '%' escaping

Status: RESOLVED DUPLICATE of bug 413250

(Core Graveyard :: RDF, defect)

Description

[Harald Albrecht]

User-Agent:       Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.3a) Gecko/20021120
Build Identifier: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.3a) Gecko/20021120

The chrome registry in mozilla/rdf/chrome/src/nsChromeRegistry.cpp offers a
function called "splitURL()", which is responsible for splitting a "chrome:" URL
into its package, provider and file parts. To avoid exploits, splitURL() checks
for "..", which could be used to gain access to files outside the chrome
directory. Currently, the code checks only for ".." and "%2E%2E". However, this
does not catch combinations of the two, that is ".%2E" and "%2E.", which are
semantically equivalent, only with a different representation form.

Reproducible: Always

Steps to Reproduce:
1. Read the source code of mozilla/rdf/chrome/src/nsChromeRegistry.cpp, lines
457 and following.

Comment 1

[Bradley Baetz (:bbaetz)]

-> security group for the moment

Normal pages can't load chrome, though - is there an exploit here, or is this
just an additional security check?

(Does resource have the same issue?)

Comment 2

[Christopher Aillon (sabbatical, not receiving bugmail)]

This belongs in RDF.

Comment 3

[Daniel Veditz [:dveditz]]

This is not much of a security hole since chrome can read any file anyways and
non-trusted content can't use chrome URLs. It's worth fixing in case some future
exploit allows untrusted content to use chrome urls, but I'm removing the
security flag because there's no exploit here.

I'm dubious RDF is the right component, but I'm sure rjc isn't the right guy.
Hyatt can grab this if he wants.

Comment 4

[Daniel Veditz [:dveditz]]

Attachment: Catch half-escaped forms

Comment 5

[jag (Peter Annema)]

Comment on attachment 107635 [details] [diff] [review]
Catch half-escaped forms

What about the escaped form of '/'?

Comment 6

[Harald Albrecht]

Yes, imho escaped slashes also need to be dealt with. And if UNICODE should be
supported one day, the dance starts over again.

Comment 7

[benc]

tever is not RDF QA anymore