Closed Bug 195317 Opened 23 years ago Closed 23 years ago

Remote content can load XBL from file:// URLs

Categories

(Core :: XBL, defect)

Product:
Core
Component:
XBL
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 200691
Milestone:
mozilla1.4beta

People

(Reporter: hjtoi-bugzilla, Assigned: bryner)

Details

While investigating bug 172673 we noticed that remote content can load XBL from users hard disk. We should block this. Please not that we still want to allow remote content to read chrome:// URLs (bug 177640). What about resource:// URLs? Any other special protocols?
-> me.
Assignee: hyatt → bryner
Target Milestone: --- → mozilla1.4beta
Flags: blocking1.4b?
This lack of security check causes an exploit - bug 200691. Duping against that one because it has more discussion and a testcase. *** This bug has been marked as a duplicate of 200691 ***
Status: NEW → RESOLVED
Closed: 23 years ago
Flags: blocking1.4b?
Resolution: --- → DUPLICATE
Dupe of bug published on the known vulnerabilities list, clearing security flag.
Group: security
You need to log in before you can comment on or make changes to this bug.