243135 - [security] Thunderbird download page allows arbitrary redirect to "evil" sites

Status: VERIFIED FIXED

(www.mozilla.org :: General, defect)

Description

[timeless]

Someone needs to tell whomever is setting up these links *not* to allow random
redirects such as this one:

http://www.mozilla.org/products/thunderbird/download.html?http%3A//www.whitehouse.com

Comment 1

[Dave Miller [:justdave]]

Reassigning to page owner, also CCing the people who last touched this page.

Note this is a security issue, please give prompt attention.

Comment 2

[Dave Miller [:justdave]]

Note that this is a really bad PR thing for Mozilla.org is someone abuses this.
 The URLs need to be validated, otherwise someone can point at the site and make
someone think they're downloading from mozilla.org and really be downloading
something else.

Comment 3

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Daniel Wang (stolenclover) checked in a partial fix for this without commenting
on this bug, but the fix isn't quite right.  I'll improve it.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

I just checked in fixes for both thunderbird and firefox download pages.  Please
verify (in 15 minutes or more).

Comment 5

[Dave Miller [:justdave]]

Firefox and Thunderbird pages both appear to be fixed.  Visual inspection of js
script source shows it will only redirect if the URL begins with
http://ftp.mozilla.org/, which is good.

However, I'd suggest verifying the pub/mozilla.org/ as well, since there's other
non-mozilla stuff accessible in other directories...  but at least you can't get
to porn with it anymore ;)

Comment 6

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

(In reply to comment #5)
> However, I'd suggest verifying the pub/mozilla.org/ as well

Done.

Comment 7

[chris hofmann]

ready to mark fixed?

Comment 8

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

yeah

Comment 9

[Daniel Veditz [:dveditz] out until Nov 10]

Confidential flag can probably be cleared now, but moving to the webtools
security group for justdave et al to make the call.