250725 - Drag-and-dropped link skips CheckLoadURI

Status: RESOLVED DUPLICATE of bug 285438

(Core :: DOM: Events, defect, P1)

Description

[Jesse Ruderman]

Requirement to exploit: 
 Convince the user to drag something (within the browser window is sufficient).

Impact:
 CheckLoadURI bypassed.  I don't remember how bad this is.

Comment 1

[Jesse Ruderman]

Attachment: demo

Demo CSS based on demo in bug 206859.

Comment 2

[Jesse Ruderman]

Attachment: demo

The other demo probably only works on Windows.	This one uses a chrome: URL
instead of a file: URL.

Comment 3

[Jesse Ruderman]

If you combine this with bug 250862, this is an arbitrary code execution hole. 
See demo in bug 250862 comment 1.

Comment 4

[Daniel Veditz [:dveditz]]

Dropping a link is considered the same thing as entering it in the URL bar and
is used by folks to load things off their desktop or from an in-browser
directory listing. Maybe the check should be when we start dragging rather than
on the dropping, but we'd have to explain why this was different than copy/paste
into a URL-bar.

I don't see a pressing reason to allow drops of non-document links like
javascript: (are there any others that don't replace the document?), as long as
it doesn't interfere with bookmarklets saved as actual bookmarks.

-> Johnny

Comment 5

[Jesse Ruderman]

Btw, this check has to be done for dragged text as well as dragged links.

Comment 6

[timeless]

personally i rely on these drags to work.

i'd rather we fix the status bar and a tooltip to not be forgable or otherwise
obscurable so that people can see what they're actually taking with them.

Comment 7

[Jesse Ruderman]

timeless: stop relying on security holes :)

Comment 8

[Johnny Stenback (:jst)]

I tested this a bit, and while it's possible to drop a chrome: URL into the
content area, it doesn't seem to be possible to do the same for a javascript: URL.

Personally I don't see how being able to drop a chrome: URL is all that bad, but
being able to drop a javascript: URL would be, but as that doesn't seem
possible, I don't see this as a serious security exploit.

Comment 9

[Jesse Ruderman]

jst: Did you try the demo in bug 250862?

Comment 10

[Johnny Stenback (:jst)]

No, I wrote up my own testcase, and obviously something went wrong there... With
that testcase I do see the bug.

I've got a patch that fixes that for Firefox, attaching...

Comment 11

[Johnny Stenback (:jst)]

Attachment: Prevent dropping javascript: and data: URLs into firefox.

Comment 12

[Johnny Stenback (:jst)]

Comment on attachment 156548 [details] [diff] [review]
Prevent dropping javascript: and data: URLs into firefox.

Moving this to bug 250725 where it belongs.

Comment 13

[chris hofmann]

minus on this one since it is now tracked in 
http://bugzilla.mozilla.org/show_bug.cgi?id=250862 

Comment 14

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 285438 ***