1886687 - Timezone leak through document.lastModified when using RFP

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Pier Angelo Vendrame]

document.lastModified is in local time, and as a result it leaks the timezone also when using RFP (e.g., when coupled with DOMParser, which will create a document modified now):

const parser = new DOMParser();
const doc = parser.parseFromString('<p></p>', 'text/html')
const lastModified = new Date(doc.lastModified.replace(/(\d{2})\/(\d{2})\/(\d{4})/, "$3-$1-$2"));
const offset = Math.ceil((lastModified - new Date()) / 1000);
document.write(offset);

We are including a fix for this in the next Tor Browser alpha release, but we are waiting for the release of April 16 to include it in the stable channel.
Therefore, I kindly ask you to keep this Bug confidential until then.
Thanks in advance.

Comment 1

[Pier Angelo Vendrame]

Attachment: Bug 1886687: Report document.lastModified in UTC when using RFP. r?tjr

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There is an r+ patch which didn't land and no activity in this bug for 2 weeks.
:pierov, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 3

[Tom Ritter [:tjr]]

We were waiting to land it, and Piero asked me today

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1afd9f5180c4
Report document.lastModified in UTC when using RFP. r=tjr

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1afd9f5180c4

Comment 6

[Thorin [:thorin]]

Attachment: verified.png

verified fixed

• the first value (DOMParser lastModified) 2024-04-17 05:29:31 is UTC time
• the second value 2024-04-17 17:29:31 [-720] is my real time (12 hrs ahead) taken from XSLT (bug 1891690)

Comment 7

[Donal Meehan [:dmeehan]]

:dveditz do want to uplift this to esr115?
(it grafts cleanly, checking before reaching out for an uplift request)

Comment 8

[Tom Ritter [:tjr]]

No - while the patch applies, it will not compile.

Comment 9

[Jesse Schwartzentruber (:truber)]

Attachment: advisory.txt

Comment 10

[Pier Angelo Vendrame]

We patched our channels downstream, so it's okay for us to lift confidentiality.
Thanks again!

Comment 11

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons