206859 - can drag text into file upload control

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[Jesse Ruderman]

Mozilla allows dragging text into file upload controls.  See the testcase for
how this can be abused.

Suggested fix: allow dragging text into normal text fields but not into file
upload controls.  (This is what IE for Windows does.)

See also:
bug 50660 Should be able to drag FILES to the file upload control
bug 57770 Using styles, clipboard to confuse text entry into file upload control

Comment 1

[Jesse Ruderman]

Attachment: Demo: "drag the smiley into the box"

Comment 2

[georgi - hopefully not receiving bugspam]

Probably internet exploder does not allow dragging into upload because IIRC
there was an exploit with only clicking which "emulated" dragging into file upload.

Comment 3

[Jesse Ruderman]

Even if Mozilla doesn't have a bug that can turn a click into a drag, I think
this should be fixed.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Over to jkeiser. I'd realy like to see this fix get into 1.4.

Comment 5

[georgi - hopefully not receiving bugspam]

I suggest a long term solution to file upload attacks - a warning that a file is
being uploaded (probably also a warning not to turn off the first warning).
This will stop also unknown file upload attacks.
Uploading files does not seem often used, so probably it won't be very annoying.

Comment 6

[John Keiser (jkeiser)]

This seems reasonable.  One can drag into the browse box anyway, and that can't
be obscured.

Comment 7

[Mitchell Stoltz (not reading bugmail)]

John, we think this is dangerous. Can we consider disallowing the dragging?

Comment 8

[Samir Gehani]

adt: nsbeta1-

Comment 9

[Asa Dotzler [:asa]]

mozilla1.4 shipped. unsetting blocking1.4 request.

Comment 10

[chris hofmann]

john, still have cycles to look at this?

Comment 11

[chris hofmann]

adding jst to cc list

Comment 12

[Johnny Stenback (:jst)]

Attachment: Don't allow dropping into file inputs.

This fixes this bug, but I'm not sure I got this in the right place. I made the
plain text data transfer code prevent dropping into form controls that don't
allow it, but is that enough? It is for this case, but can others think of
other cases that this might not cover?

Comment 13

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 137698 [details] [diff] [review]
Don't allow dropping into file inputs.

I'm wondering if we can avoid getting this far altogether (when we get a drop
event in a form control which doesn't allow dropping, I think we should be able
to avoid even calling the editor methods).    If you want to land this, though,
r=caillon since this route is also fine.  One other thing I'd ask is whether we
want to also consider adding a similar check to nsHTMLDataTransfer.cpp in case
someone wants to disable dropping in their implementation for HTML widgets?

Comment 14

[Johnny Stenback (:jst)]

Comment on attachment 137698 [details] [diff] [review]
Don't allow dropping into file inputs.

I'm kinda leaning towards leaving the code where I originally put it, though
I'm not opposed to finding another place for it, but for now I think I'd prefer
to leave it. And I'm having a hard time imagining a situation where we'd have a
HTML widget form control that doesn't allow dropping into. So I'm going to
leave this as is unless I hear convinsing arguments for moving this check.

Comment 15

[Johnny Stenback (:jst)]

Comment on attachment 137698 [details] [diff] [review]
Don't allow dropping into file inputs.

Duh, forgot to land this last night. It's a security problem, so I'd vote for
taking this for 1.7a.

Comment 16

[chris hofmann]

Comment on attachment 137698 [details] [diff] [review]
Don't allow dropping into file inputs.

a=chofmann for 1.7a

Comment 17

[Johnny Stenback (:jst)]

Fixed.

Comment 18

[Tracy Walker [:tracy]]

verified with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b)
Gecko/20040421

Comment 19

[Daniel Veditz [:dveditz]]

Adding Jon Granrose to CC list to help round up QA resources for verification

Comment 20

[Christopher Aillon (sabbatical, not receiving bugmail)]

Comment on attachment 137698 [details] [diff] [review]
Don't allow dropping into file inputs.

a=blizzard for 1.4.3

Comment 21

[Christopher Aillon (sabbatical, not receiving bugmail)]

Fixed on the 1.4 branch

Comment 22

[Daniel Veditz [:dveditz]]

Removing security-sensitive flag for bugs on the known-vulnerabilities list