Closed
Bug 245140
Opened 22 years ago
Closed 22 years ago
Mail follows <ul style="list-style-image:url(http://...> tags, which helps spammers do positive address farming
Categories
(SeaMonkey :: MailNews: Message Display, defect)
Tracking
(Not tracked)
RESOLVED
DUPLICATE
of bug 188955
People
(Reporter: nc, Assigned: sspitzer)
Details
(Whiteboard: [sg:dupe 188955])
Attachments
(1 file)
|
3.79 KB,
text/plain
|
Details |
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a2) Gecko/20040529
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8a2) Gecko/20040529
So, it used to be that if I wanted to help prevent someone from address farming
in Mozilla mail, I would turn off Javascript in Mail/News, and turn on "Do not
load remote images". That way, they have no way that I've actually read a
certain piece of spam.
Just noticed that spammers started to do something like this:
<ul
style="list-style-image:url(http://foo.bar.net/mail/view.php?cid=03a6071597d644d68477d6a777d653360767&sid=2&cmpid=BUG50);color:white"><li></ul>
("foo.bar.net" is actually "tr.memorialtimed.com", but didn't want more hits on
that link...)
which Mozilla happily follows. It even accepts the cookie if offered.
Reproducible: Always
Steps to Reproduce:
1. Open a certain piece of mail that has the above tag.
2.
3.
Actual Results:
Mail tries to follow that link. Spammer now knows the piece of mail has been opened.
Expected Results:
The link should not have been followed if remote images is turned off.
Don't know if this is a real "security" issue, but it'd be bad if every farming
spammer used this technique...
|
Assignee | |
Comment 1•22 years ago
|
||
yikes, I don't like the sound of this one.
I'll first verify that this privacy hole exists.
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
|
|
Reporter | |
Comment 2•22 years ago
|
||
|
|
Assignee | |
Comment 3•22 years ago
|
||
if I mark as junk, I don't think I see the image.
but if I just do "don't load remote images", I think we load it.
(at least with tbird.)
let me try trunk / 1.7 seamonkey, too.
I wonder if the problem is we block remote <img> tags, but not remote
"list-style-image", like you've found.
|
|
Assignee | |
Comment 4•22 years ago
|
||
yes, this is a real privacy hole.
some other things I need to look at:
1) content policy is checking some chrome urls (see if this is a perf problem)
2) content policy blocks insert image into mail compose (I think this was an
existing bug that I fixed, or at least had a patch for, I'll check)
but first I'll work on the privacy hole that affect tbird and seamonkey.
|
|
Assignee | |
Comment 5•22 years ago
|
||
ok, for seamonkey (tbird has a different policy handler, but I'm sure it is the
same there),
I never get into nsImgManager::ShouldLoad(), so I never get asked to not load it.
|
|
Assignee | |
Comment 6•22 years ago
|
||
when I do get asked (for <img src="...">, here's my stack:
> cookie.dll!nsImgManager::ShouldLoad(int aContentType=2, nsIURI *
aContentLoc=0x039efa88, nsISupports * aContext=0x039ef928, nsIDOMWindow *
aWindow=0x0370968c, int * aShouldLoad=0x0012efb0) Line 170 C++
gklayout.dll!nsContentPolicy::CheckPolicy(int policyType=0, int contentType=2,
nsIURI * contentLocation=0x039efa88, nsISupports * context=0x039ef928,
nsIDOMWindow * window=0x0370968c, int * shouldProceed=0x0012efb0) Line 140 +
0x2b C++
gklayout.dll!nsContentPolicy::ShouldLoad(int contentType=2, nsIURI *
contentLocation=0x039efa88, nsISupports * context=0x039ef928, nsIDOMWindow *
window=0x0370968c, int * shouldLoad=0x0012efb0) Line 167 C++
gklayout.dll!NS_CheckContentLoadPolicy(int contentType=2, nsIURI *
aURI=0x039efa88, nsISupports * context=0x039ef928, nsIDOMWindow *
window=0x0370968c, int * shouldLoad=0x0012efb0) Line 56 + 0x70 C++
gklayout.dll!nsContentUtils::CanLoadImage(nsIURI * aURI=0x039efa88,
nsISupports * aContext=0x039ef928, nsIDocument * aLoadingDocument=0x0392f5e8)
Line 1697 + 0x1c C++
gklayout.dll!nsImageLoadingContent::ImageURIChanged(const nsACString &
aNewURI={...}) Line 412 + 0x1b C++
gklayout.dll!nsImageLoadingContent::ImageURIChanged(const nsAString &
aNewURI={...}) Line 378 + 0x15 C++
gklayout.dll!nsHTMLImageElement::SetParent(nsIContent * aParent=0x039ef6e0)
Line 658 C++
gklayout.dll!nsGenericElement::AppendChildTo(nsIContent * aKid=0x039ef908, int
aNotify=0, int aDeepSetDocument=0) Line 2559 C++
gklayout.dll!SinkContext::AddLeaf(nsIHTMLContent * aContent=0x039ef908)
Line 1625 C++
gklayout.dll!SinkContext::AddLeaf(const nsIParserNode & aNode={...}) Line
1553 C++
gklayout.dll!HTMLContentSink::AddLeaf(const nsIParserNode & aNode={...}) Line
3213 + 0x12 C++
gkparser.dll!CNavDTD::AddLeaf(const nsIParserNode * aNode=0x038d7000) Line
3787 + 0x19 C++
gkparser.dll!CNavDTD::HandleDefaultStartToken(CToken * aToken=0x03950510,
nsHTMLTag aChildTag=eHTMLTag_img, nsCParserNode * aNode=0x038d7000) Line 1460
+ 0xc C++
gkparser.dll!CNavDTD::HandleStartToken(CToken * aToken=0x03950510) Line
1835 + 0x14 C++
gkparser.dll!CNavDTD::HandleToken(CToken * aToken=0x03950510, nsIParser *
aParser=0x037e96a0) Line 1019 + 0xc C++
gkparser.dll!CNavDTD::BuildModel(nsIParser * aParser=0x037e96a0, nsITokenizer
* aTokenizer=0x039d5b90, nsITokenObserver * anObserver=0x00000000,
nsIContentSink * aSink=0x037e97e8) Line 511 + 0x14 C++
gkparser.dll!nsParser::BuildModel() Line 1894 + 0x22 C++
gkparser.dll!nsParser::ResumeParse(int allowIteration=1, int aIsFinalChunk=1,
int aCanInterrupt=1) Line 1761 + 0xc C++
gkparser.dll!nsParser::ContinueParsing() Line 1359 + 0x13 C++
gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x038e6658, int aSucceeded=1) Line 1532 C++
gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x03945d18, int aSucceeded=1) Line 1550 C++
gklayout.dll!CSSLoaderImpl::ParseSheet(nsIUnicharInputStream *
aStream=0x03928ce0, SheetLoadData * aLoadData=0x03945d18, int & aCompleted=1)
Line 1467 C++
gklayout.dll!SheetLoadData::OnStreamComplete(nsIUnicharStreamLoader *
aLoader=0x03945d98, nsISupports * aContext=0x00000000, unsigned int aStatus=0,
nsIUnicharInputStream * aDataStream=0x03928ce0) Line 805 + 0x17 C++
necko.dll!nsUnicharStreamLoader::OnStopRequest(nsIRequest *
request=0x039b4fd0, nsISupports * ctxt=0x00000000, unsigned int aStatus=0)
Line 196 C++
necko.dll!nsJARChannel::OnStopRequest(nsIRequest * req=0x038e86d8, nsISupports
* ctx=0x00000000, unsigned int status=0) Line 672 C++
necko.dll!nsInputStreamPump::OnStateStop() Line 499 C++
necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *
stream=0x038e87b4) Line 339 + 0xb C++
xpcom.dll!nsInputStreamReadyEvent::EventHandler(PLEvent * plevent=0x038e8b74)
Line 119 C++
xpcom.dll!PL_HandleEvent(PLEvent * self=0x038e8b74) Line 673 + 0xa C
xpcom.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x009f0788) Line 608
+ 0x9 C
xpcom.dll!_md_EventReceiverProc(HWND__ * hwnd=0x003302dc, unsigned int
uMsg=49603, unsigned int wParam=0, long lParam=10422152) Line 1414 + 0x9 C
user32.dll!77d43a50()
user32.dll!77d43b1f()
user32.dll!77d43d79()
user32.dll!77d43fd4()
user32.dll!77d43ddf()
gkwidget.dll!nsAppShell::Run() Line 135 C++
appshell.dll!nsAppShellService::Run() Line 524 C++
mozilla.exe!main1(int argc=2, char * * argv=0x002a3180, nsISupports *
nativeApp=0x00a27db0) Line 1303 + 0x20 C++
mozilla.exe!main(int argc=2, char * * argv=0x002a3180) Line 1780 + 0x25 C++
mozilla.exe!mainCRTStartup() Line 398 + 0x11 C
kernel32.dll!77e814c7()
|
|
Assignee | |
Comment 7•22 years ago
|
||
ah, notice in that stack:
nsHTMLImageElement and nsImageLoadingContent::ImageURIChanged()
<ul style="list-style-image:url(http://...> is not a nsHTMLImageElement.
|
|
Assignee | |
Comment 8•22 years ago
|
||
ok, I have a feeling I'll need the help of jst, dbaron and hixie on this one.
in addition to list-style-image, how else can people sneak through images?
I'm doing this http://lxr.mozilla.org/mozilla/search?string=mListStyleImage
search to see maybe the common place to ask the policy manager if it is safe to
load the image.
|
|
Assignee | |
Comment 9•22 years ago
|
||
ok, so here's one place where we call LoadImage() without checking the policy:
> gklayout.dll!nsBulletFrame::Init(nsIPresContext * aPresContext=0x039ea340,
nsIContent * aContent=0x038f71f8, nsIFrame * aParent=0x039bb178, nsStyleContext
* aContext=0x039bb398, nsIFrame * aPrevInFlow=0x00000000) Line 157 C++
gklayout.dll!nsBlockFrame::SetInitialChildList(nsIPresContext *
aPresContext=0x039ea340, nsIAtom * aListName=0x00000000, nsIFrame *
aChildList=0x039bb218) Line 6188 C++
gklayout.dll!nsCSSFrameConstructor::ConstructBlock(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, const nsStyleDisplay *
aDisplay=0x039bb124, nsIContent * aContent=0x038f71f8, nsIFrame *
aParentFrame=0x039bafc8, nsIFrame * aContentParentFrame=0x00000000,
nsStyleContext * aStyleContext=0x039bad34, nsIFrame * aNewFrame=0x039bb178, int
aRelPos=0) Line 12522 C++
gklayout.dll!nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, const nsStyleDisplay *
aDisplay=0x039bb124, nsIContent * aContent=0x038f71f8, int aNameSpaceID=3,
nsIAtom * aTag=0x009c4800, nsIFrame * aParentFrame=0x039bafc8, nsStyleContext *
aStyleContext=0x039bad34, nsFrameItems & aFrameItems={...}) Line 6288 + 0x2f C++
gklayout.dll!nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, nsIContent * aContent=0x038f71f8,
nsIFrame * aParentFrame=0x039bafc8, nsIAtom * aTag=0x009c4800, int
aNameSpaceID=3, nsStyleContext * aStyleContext=0x039bad34, nsFrameItems &
aFrameItems={...}, int aXBLBaseTag=0) Line 7179 + 0x35 C++
gklayout.dll!nsCSSFrameConstructor::ConstructFrame(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, nsIContent * aContent=0x038f71f8,
nsIFrame * aParentFrame=0x039bafc8, nsFrameItems & aFrameItems={...}) Line
7040 + 0x33 C++
gklayout.dll!nsCSSFrameConstructor::ProcessChildren(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, nsIContent * aContent=0x039299a0,
nsIFrame * aFrame=0x039bafc8, int aCanHaveGeneratedContent=1, nsFrameItems &
aFrameItems={...}, int aParentIsBlock=1, nsTableCreator *
aTableCreator=0x00000000) Line 11464 + 0x42 C++
gklayout.dll!nsCSSFrameConstructor::ConstructBlock(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, const nsStyleDisplay *
aDisplay=0x039baf74, nsIContent * aContent=0x039299a0, nsIFrame *
aParentFrame=0x039bab8c, nsIFrame * aContentParentFrame=0x00000000,
nsStyleContext * aStyleContext=0x039badd4, nsIFrame * aNewFrame=0x039bafc8, int
aRelPos=0) Line 12513 + 0x26 C++
gklayout.dll!nsCSSFrameConstructor::ConstructFrameByDisplayType(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, const nsStyleDisplay *
aDisplay=0x039baf74, nsIContent * aContent=0x039299a0, int aNameSpaceID=3,
nsIAtom * aTag=0x009c4ae8, nsIFrame * aParentFrame=0x039bab8c, nsStyleContext *
aStyleContext=0x039badd4, nsFrameItems & aFrameItems={...}) Line 6288 + 0x2f C++
gklayout.dll!nsCSSFrameConstructor::ConstructFrameInternal(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, nsIContent * aContent=0x039299a0,
nsIFrame * aParentFrame=0x039bab8c, nsIAtom * aTag=0x009c4ae8, int
aNameSpaceID=3, nsStyleContext * aStyleContext=0x039badd4, nsFrameItems &
aFrameItems={...}, int aXBLBaseTag=0) Line 7179 + 0x35 C++
gklayout.dll!nsCSSFrameConstructor::ConstructFrame(nsIPresShell *
aPresShell=0x038a56c0, nsIPresContext * aPresContext=0x039ea340,
nsFrameConstructorState & aState={...}, nsIContent * aContent=0x039299a0,
nsIFrame * aParentFrame=0x039bab8c, nsFrameItems & aFrameItems={...}) Line
7040 + 0x33 C++
gklayout.dll!nsCSSFrameConstructor::ContentAppended(nsIPresContext *
aPresContext=0x039ea340, nsIContent * aContainer=0x039bd1b0, int
aNewIndexInContainer=1) Line 8307 C++
gklayout.dll!PresShell::ContentAppended(nsIDocument * aDocument=0x0393fb28,
nsIContent * aContainer=0x039bd1b0, int aNewIndexInContainer=1) Line 5221 C++
gklayout.dll!nsDocument::ContentAppended(nsIContent * aContainer=0x039bd1b0,
int aNewIndexInContainer=1) Line 1946 C++
gklayout.dll!nsHTMLDocument::ContentAppended(nsIContent *
aContainer=0x039bd1b0, int aNewIndexInContainer=1) Line 1199 C++
gklayout.dll!HTMLContentSink::NotifyAppend(nsIContent * aContainer=0x039bd1b0,
unsigned int aStartIndex=1) Line 4130 C++
gklayout.dll!SinkContext::CloseContainer(nsHTMLTag aTag=eHTMLTag_div) Line
1438 C++
gklayout.dll!HTMLContentSink::CloseContainer(nsHTMLTag aTag=eHTMLTag_div)
Line 3134 + 0x12 C++
gkparser.dll!CNavDTD::CloseContainer(nsHTMLTag aTag=eHTMLTag_div, nsHTMLTag
aTarget=eHTMLTag_div, int aClosedByStartTag=0) Line 3545 + 0x1f C++
gkparser.dll!CNavDTD::CloseContainersTo(int anIndex=2, nsHTMLTag
aTarget=eHTMLTag_div, int aClosedByStartTag=0) Line 3577 + 0x14 C++
gkparser.dll!CNavDTD::CloseContainersTo(nsHTMLTag aTag=eHTMLTag_div, int
aClosedByStartTag=0) Line 3735 + 0x14 C++
gkparser.dll!CNavDTD::HandleEndToken(CToken * aToken=0x03948328) Line 2097
+ 0xe C++
gkparser.dll!CNavDTD::HandleToken(CToken * aToken=0x03948328, nsIParser *
aParser=0x038da440) Line 1022 + 0xc C++
gkparser.dll!CNavDTD::BuildModel(nsIParser * aParser=0x038da440, nsITokenizer
* aTokenizer=0x03652bd0, nsITokenObserver * anObserver=0x00000000,
nsIContentSink * aSink=0x03623368) Line 511 + 0x14 C++
gkparser.dll!nsParser::BuildModel() Line 1894 + 0x22 C++
gkparser.dll!nsParser::ResumeParse(int allowIteration=1, int aIsFinalChunk=1,
int aCanInterrupt=1) Line 1761 + 0xc C++
gkparser.dll!nsParser::ContinueParsing() Line 1359 + 0x13 C++
gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x038ea2b0, int aSucceeded=1) Line 1532 C++
gklayout.dll!CSSLoaderImpl::SheetComplete(SheetLoadData *
aLoadData=0x039d67e0, int aSucceeded=1) Line 1550 C++
gklayout.dll!CSSLoaderImpl::ParseSheet(nsIUnicharInputStream *
aStream=0x037dbfb0, SheetLoadData * aLoadData=0x039d67e0, int & aCompleted=1)
Line 1467 C++
gklayout.dll!SheetLoadData::OnStreamComplete(nsIUnicharStreamLoader *
aLoader=0x039d6860, nsISupports * aContext=0x00000000, unsigned int aStatus=0,
nsIUnicharInputStream * aDataStream=0x037dbfb0) Line 805 + 0x17 C++
necko.dll!nsUnicharStreamLoader::OnStopRequest(nsIRequest *
request=0x039d6c40, nsISupports * ctxt=0x00000000, unsigned int aStatus=0)
Line 196 C++
necko.dll!nsJARChannel::OnStopRequest(nsIRequest * req=0x038c6e40, nsISupports
* ctx=0x00000000, unsigned int status=0) Line 672 C++
necko.dll!nsInputStreamPump::OnStateStop() Line 499 C++
necko.dll!nsInputStreamPump::OnInputStreamReady(nsIAsyncInputStream *
stream=0x038c6ec4) Line 339 + 0xb C++
xpcom.dll!nsInputStreamReadyEvent::EventHandler(PLEvent * plevent=0x038c70d4)
Line 119 C++
xpcom.dll!PL_HandleEvent(PLEvent * self=0x038c70d4) Line 673 + 0xa C
xpcom.dll!PL_ProcessPendingEvents(PLEventQueue * self=0x009f0788) Line 608
+ 0x9 C
xpcom.dll!_md_EventReceiverProc(HWND__ * hwnd=0x003302dc, unsigned int
uMsg=49603, unsigned int wParam=0, long lParam=10422152) Line 1414 + 0x9 C
user32.dll!77d43a50()
user32.dll!77d43b1f()
user32.dll!77d43d79()
user32.dll!77d43fd4()
user32.dll!77d43ddf()
gkwidget.dll!nsAppShell::Run() Line 135 C++
appshell.dll!nsAppShellService::Run() Line 524 C++
mozilla.exe!main1(int argc=2, char * * argv=0x002a3180, nsISupports *
nativeApp=0x00a27db0) Line 1303 + 0x20 C++
mozilla.exe!main(int argc=2, char * * argv=0x002a3180) Line 1780 + 0x25 C++
mozilla.exe!mainCRTStartup() Line 398 + 0x11 C
kernel32.dll!77e814c7()
|
|
Assignee | |
Comment 10•22 years ago
|
||
there might be other places we call LoadImage() on the image loader without
checking policy.
http://lxr.mozilla.org/mozilla/search?string=%40mozilla.org%2Fimage%2Floader%3B1
|
|
||
Comment 11•22 years ago
|
||
cc'ing mvl on this too as he's been interested in this stuff.
|
|
||
Comment 12•22 years ago
|
||
We have all sorts of places that don't call content policy. Now that the
content policy API has been updated a bit, we're working on adding callers, one
at a time (to test for performance impact).
The dependencies of bug 191839 should include some of the bugs that we need to
fix, and the patches in that bug have fixes for some of them. I doubt either
list is exhaustive, though.
*** This bug has been marked as a duplicate of 188955 ***
Status: ASSIGNED → RESOLVED
Closed: 22 years ago
Resolution: --- → DUPLICATE
|
|
Assignee | |
Comment 13•22 years ago
|
||
> 2) content policy blocks insert image into mail compose (I think this was an
> existing bug that I fixed, or at least had a patch for, I'll check)
see bug #206793, not sure if that was really landed or not. I'll investigate.
|
||
Updated•22 years ago
|
Group: security
Whiteboard: [sg:dupe 188955]
|
||
Updated•21 years ago
|
Product: Browser → Seamonkey
You need to log in
before you can comment on or make changes to this bug.
Description
•