Closed
Bug 246122
Opened 21 years ago
Closed 21 years ago
Add bugzilla.mozilla.org to xpinstall blacklist
Categories
(Core Graveyard :: Installer: XPInstall Engine, defect)
Core Graveyard
Installer: XPInstall Engine
Tracking
(Not tracked)
RESOLVED
WONTFIX
People
(Reporter: dveditz, Assigned: dveditz)
References
Details
(Whiteboard: [sg:fix])
Attachments
(1 file)
801 bytes,
patch
|
Details | Diff | Splinter Review |
bug 240552 comment 59 raised the possibility of an attacker opening a
whitelisted site in a frame and poking its DOM to launch an install. That
shouldn't be possible due to the same-origin policy, but just about anybody
could add an install-launching bugzilla attachment fairly anonymously and then
load that in a frame/window.
Assignee | ||
Updated•21 years ago
|
Flags: blocking1.7?
Whiteboard: [sg:fix]
Assignee | ||
Comment 1•21 years ago
|
||
Assignee | ||
Comment 2•21 years ago
|
||
Not blocking 1.7--we're going to turn off the whitelisting for the release until
we get some UI for it and we don't want bugzilla testcase attachments to
mysteriously fail in the meanwhile.
Flags: blocking1.7? → blocking1.7-
Comment 3•21 years ago
|
||
Instead of having mozilla.org on the whitelist and the subdomain
bugzilla.mozilla.org on the blacklist, how about having update.mozilla.org on
the whitelist?
Assignee | ||
Comment 4•21 years ago
|
||
That's definitely what Ben's going to do for Firefox. I thought that was too
restrictive, but maybe we'd only need updates.mozilla.org and ftp.mozilla.org
for the suite. There are probably some test cases on www.mozilla.org, but
testers could easily add that one themselves.
Assignee | ||
Comment 5•21 years ago
|
||
We don't need to fix this one as long as we don't whitelist mozilla.org.
Currently the plan is to whitelist only update.mozilla.org
Group: security
Status: NEW → RESOLVED
Closed: 21 years ago
Resolution: --- → WONTFIX
Updated•10 years ago
|
Product: Core → Core Graveyard
You need to log in
before you can comment on or make changes to this bug.
Description
•