212298 - Simple JS trick to close window without permission

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Zibi Braniecki [:zbraniecki][:gandalf]]

Once more. This script hacks out policy and close main window (opened by user)
without ay confirmation.
Since we're the only browser which fixed bug with overwriting opener=self, i
think that this one has to be fixed too.

Comment 1

[Zibi Braniecki [:zbraniecki][:gandalf]]

Agh. Summary=>URL

Comment 2

[Phil Schwartau]

JS Engine not the right component for this issue. Security? DOM?
Reassigning to Security as a guess; please reassign if incorrect.

Comment 3

[Boris Zbarsky [:bzbarsky]]

"The requested URL /testy/close.html was not found on this server." when loading
http://www.mxstudio.homeschool.pl/testy/close.html

Please point to a useful testcase?

Comment 4

[Zibi Braniecki [:zbraniecki][:gandalf]]

Attachment: testcase

Sorry Boris.

Comment 5

[Boris Zbarsky [:bzbarsky]]

cute... ccing some interested parties.

Comment 6

[Zibi Braniecki [:zbraniecki][:gandalf]]

isn't it? 

As i remember there was a patch few months ago to make |opener| readonly. Strange?

Comment 7

[Boris Zbarsky [:bzbarsky]]

*** Bug 245402 has been marked as a duplicate of this bug. ***

Comment 8

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #6)
> As i remember there was a patch few months ago to make |opener| readonly. Strange?

The trick was window.open("",window.self.name) and next coding was sufficient.
 w=window.self;w.name="foo";wx=window.open("","foo");
 => window.self.opener.name was set to myself("foo" when above coding).

In addition to this, seamonkey 2005120309-trunk/win-2K issued next error message on JavaScript Console when "wx.opener='foo';" was executed, even after above successuful opener change by window.open.
> Error: uncaught exception: [Exception... "Could not convert JavaScript
> argument arg 0 [nsIDOMWindowInternal.opener]"  nsresult: "0x80570009
> (NS_ERROR_XPC_BAD_CONVERT_JS)"  location: "JS frame ::
It seems to be an evidence that direct window.opener peoperty change by HTML is currently impossibile or inhibited.

Can HTML script of window.open("","foo") change opener of already opened/named window by other domain?
Or it is same domain case only?

Comment 9

[HARUNAGA Hirotoshi]

Bug 214986 and Bug 266371 are dups of this?

Comment 10

[Boris Zbarsky [:bzbarsky]]

*** Bug 214986 has been marked as a duplicate of this bug. ***

Comment 11

[Boris Zbarsky [:bzbarsky]]

Fixed on trunk by patch for bug 266371