224954 - CSS allows to check history via :visited

Status: VERIFIED DUPLICATE of bug 147777

(Core :: Security, defect)

Description

[Zibi Braniecki [:zbraniecki][:gandalf]]

There is a hole in Mozilla's CSS :visited anchor support allowing any potential
script to check if user visited some pages and of course siletly send those
informations anywhere.

How does it work? Script has to create anchor and check if it's color is the
same as a:visited one. If so - page was visited. 
OF course it doesn't give access to whole history, but it's still very, very big
hole.

For example I can check if visitor visited my sponsor site and if not, i wont
allow him to visit my site.

Steps to reproduce:
1) Open Attachment

Actual result:
Script can tell me what pages i visited


Expected result:
Script shouldn't have access to personal data like history. Meaby links should
be colorized, but color value should stay?

Comment 1

[Zibi Braniecki [:zbraniecki][:gandalf]]

Attachment: testcase

Comment 2

[Christopher Aillon (sabbatical, not receiving bugmail)]

*** This bug has been marked as a duplicate of 147777 ***

Comment 3

[Eric Jung [:ericjung]]

Here's a site which demonstrates this security risk:
http://gemal.dk/browserspy/css.html