293330 - Remove XPI install delay without changing any about:config prefs

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, defect)

Description

[Matthew Mastracci]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7) Gecko/20050416 Fedora/1.0.3-1.3.1 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7) Gecko/20050416 Fedora/1.0.3-1.3.1 Firefox/1.0.3

My report to [e-mail]:

An attacker can "kill" the XPI delay on the installation dialog by providing a
javascript IconURL that throws an exception.  In the sample exploit, "alert" is
used as it doesn't exist on a chrome window and throws an exception.  The sample
exploit tricks the user into installing an XPI by making them press enter over
and over, then popping up the "no wait" dialog.  Without the delay, a user may
inadvertently install a malicious XPI. 

See attached testcase.

Reproducible: Always

Steps to Reproduce:

Comment 1

[Matthew Mastracci]

Attachment: Testcase for security bug

Comment 2

[Daniel Veditz [:dveditz]]

Confirming. Depends on bug 292499

Comment 3

[Daniel Veditz [:dveditz]]

javascript icons no longer allowed, so thrown exceptions won't mess up the delay
count.