214721 - long xpi filename can push "Cancel" button off screen

Status: VERIFIED FIXED

(Core Graveyard :: Installer: XPInstall Engine, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030730 Mozilla
Firebird/0.6.1

An XPI with a very long filename pushes the Cancel button off the screen, making
it look like Install is the only button [screenshot 1].  A slightly longer
filename pushes enough of the Install button off of the screen that you can't
tell what the button says [screenshot 2].

This is a security hole.  I would expect to have a high success rate with this
attack, even though the "close window" button in the titlebar is still available.

Comment 1

[Jesse Ruderman]

Attachment: screenshot 1: looks like Install is the only button

Comment 2

[Jesse Ruderman]

Attachment: screenshot 2: only part of Install button is visible

Comment 3

[chris hofmann]

ssu, do you have cycles to work on this?

Comment 4

[Asa Dotzler [:asa]]

blake or ben, can you look at this. it doesn't look very difficult.

Comment 5

[(not reading, please use [e-mail] instead)]

note, the file in question is
http://lxr.mozilla.org/mozilla/source/xpinstall/res/content/institems.xul

Comment 6

[(not reading, please use [e-mail] instead)]

Attachment: the start of a patch

Comment 7

[(not reading, please use [e-mail] instead)]

bad things can still happen if you make this dialog too narrow.

also, this uses window and not dialog (it must be one of the old, old dialogs)

let me look into that.

Comment 8

[(not reading, please use [e-mail] instead)]

Attachment: patch

Comment 9

[Ben Goodger (use ben at mozilla dot org for email)]

Comment on attachment 130701 [details] [diff] [review]
patch

r=[e-mail]

Comment 10

[(not reading, please use [e-mail] instead)]

Attachment: updated patch

Comment 11

[(not reading, please use [e-mail] instead)]

taking

Comment 12

[(not reading, please use [e-mail] instead)]

fixed, thanks to ben for the review.

Comment 13

[Asa Dotzler [:asa]]

Comment on attachment 130702 [details] [diff] [review]
updated patch

a=asa (on behalf of drivers) for checkin to Mozilla 1.5

Comment 14

[(not reading, please use [e-mail] instead)]

the current UI for dialog is:

<name> <cert name> <full url>

you can still run into some less than desirable appearance issues if any of
those are overly long (but at least the buttons will be on screen).

I'm sure the UI could be improved, and I'll log a bug to track that.

Comment 15

[(not reading, please use [e-mail] instead)]

spun off the UI issue to bug #218030

Comment 16

[Asa Dotzler [:asa]]

drivers, do we want this for 1.4?

Comment 17

[Daniel Veditz [:dveditz]]

fixed in 1.5, removing security flag

Comment 18

[Mike Kaply [:mkaply]]

Comment on attachment 130702 [details] [diff] [review]
updated patch

a=mkaply for 1.4.2

Comment 19

[Tracy Walker [:tracy]]

verified XPI file names no longer push buttons out of view.

NPWINMCIMIDI.xpi get's crunched to NPWIN....xpi