20682 - Frame spoofing #2

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

There is a vulnerability, which allows spoofing frames.
The code is:
------------------------------------------
<SCRIPT>
b=window.open("http://www.citybank.com");
setTimeout('b.frames[2].location="http://www.mozilla.org";',6000);
</SCRIPT>
------------------------------------------
Communicator 4.7 gives security error on this.

Comment 1

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 2

[Jim Roskind]

I don't see signs of progress for M15, and since Norris is out this week, I'm 
pushing this to M16 (so that we can branch)

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Bulk reassigning most of norris's bugs to mstoltz.

Comment 4

[leger]

Putting on [nsbeta2+] radar for beta2 fix.

Comment 5

[Paul Wyskoczka]

Changed QA contact to Cathy.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

I have reproduced this bug. Looks like, for whatever reason, we don't check
writing to "location", only reading.

Comment 7

[John Unruh]

Assigning QA to czhang

Comment 8

[Mitchell Stoltz (not reading bugmail)]

This will be fixed by defaulting to sameOrigin; otherwise, we need to check
location.href.write as well as .read.

Comment 9

[John Taylor]

Looks fixed with 7/6 build on NT. Try new testcase:
http://rocknroll/users/jtaylor/publish/TestCases/xdomain/frames.html

Comment 10

[Mitchell Stoltz (not reading bugmail)]

Fix confirmed by jtaylor. Marking FIXED.

Comment 11

[cathy zhang]

verified

Comment 12

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.

Comment 13

[Boris Zbarsky [:bzbarsky]]

Test for this got added in bug 408052.