291745 - cross site scripting if the user opens a link and then presses "back"

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[Paul Nickerson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

if a specially crafted javascript url navigates to another site, pressing "back"
on the new site will navigate to the javascript url, executing the script

Reproducible: Always

Steps to Reproduce:
1. http://greyhatsecurity.org/vulntests/more/cookies.htm
2. wait 5 seconds (this can be changed to no wait at all, i just wanted to give
you guys a chance to view the source)
3. click the link that shows up when the page loads
4. press the back button after the page loads

Actual Results:  
cross site scripting in the context of the loaded page

Expected Results:  
javascript urls should not be stored in history.

Comment 1

[Daniel Veditz [:dveditz]]

Confirming. Mozilla Suite is unaffected.

Comment 2

[Daniel Veditz [:dveditz]]

*** Bug 291838 has been marked as a duplicate of this bug. ***

Comment 3

[Daniel Veditz [:dveditz]]

Mozilla suite 1.7.7 (only) is affected by this. Comment 1 was based on testing a
different version that was not affected by this regression from bug 289074

Fixed as part of bug 292691

Comment 4

[Daniel Veditz [:dveditz]]

*** Bug 292298 has been marked as a duplicate of this bug. ***

Comment 5

[Daniel Veditz [:dveditz]]

I guess this isn't checked into the trunk yet

Comment 6

[Daniel Veditz [:dveditz]]

nominating for Bug Bounty, this appears to be the earliest of the history.back()
javascript:eval() bugs.

Comment 7

[Daniel Veditz [:dveditz]]

Fix checked into trunk as part of bug 292691

Comment 8

[Daniel Veditz [:dveditz]]

Clearing security flag from announced vulnerabilities fixed in Firefox
1.0.4/Mozilla 1.7.8

Comment 9

[Daniel Veditz [:dveditz]]

*** Bug 292687 has been marked as a duplicate of this bug. ***

Comment 10

[Paul Nickerson]

Testcase for regression-testing:
javascript:"<a href='http://google.com'>click here and then press back</a><br><br>location.href:"+location.href+"<br>document.cookie:"+document.cookie