246122 - Add bugzilla.mozilla.org to xpinstall blacklist

Status: RESOLVED WONTFIX

Description

[Daniel Veditz [:dveditz]]

bug 240552 comment 59 raised the possibility of an attacker opening a
whitelisted site in a frame and poking its DOM to launch an install. That
shouldn't be possible due to the same-origin policy, but just about anybody
could add an install-launching bugzilla attachment fairly anonymously and then
load that in a frame/window.

Comment 1

[Daniel Veditz [:dveditz]]

Created attachment 150460 [details] [diff] [review]
add to blacklist

Comment 2

[Daniel Veditz [:dveditz]]

Not blocking 1.7--we're going to turn off the whitelisting for the release until
we get some UI for it and we don't want bugzilla testcase attachments to
mysteriously fail in the meanwhile.

Comment 3

[Jesse Ruderman]

Instead of having mozilla.org on the whitelist and the subdomain
bugzilla.mozilla.org on the blacklist, how about having update.mozilla.org on
the whitelist?

Comment 4

[Daniel Veditz [:dveditz]]

That's definitely what Ben's going to do for Firefox. I thought that was too
restrictive, but maybe we'd only need updates.mozilla.org and ftp.mozilla.org
for the suite.  There are probably some test cases on www.mozilla.org, but
testers could easily add that one themselves.

Comment 5

[Daniel Veditz [:dveditz]]

We don't need to fix this one as long as we don't whitelist mozilla.org.
Currently the plan is to whitelist only update.mozilla.org