User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
XPConnect wrapped native objects' "QueryInterface" method is a native
function which (erroneously) exposes the privileged Function constructor
as its constructor. Such privileged constructor can be accessed by an
expression such as "QueryInterface.constructor", and allows attackers
to construct and execute arbitrary privileged code.
Steps to Reproduce:
1. load the testcase.
The privileged Function constructor can be accessed by
QueryInterface.constructor and allows to execute arbitary code.
The privileged Function constructor must not be accessable at all.
(QueryInterface.constructor == Function) is true.
Created attachment 184163 [details]
testcase for the problem.
Confirmed, trunk Linux build.
That said, this may be a duplicate of bug 294795.
My Firefox 1.0.4 on WinXP, returns false for the "(QueryInterface.constructor ==
Function)" test. When I load the testcase, I do not see an alert. Hmm...
The one liner from comment #2 triggers the following exception:
Error: uncaught exception: Permission denied to get property UnnamedClass.classes
Could my Firefox be configured funny?
confirming on linux - both 1.0.4 and today's cvs trunk.
This doesn't seem limited to QueryInterface.
window.document.location.toString();")()); gives me
chrome://browser/content/hiddenWindow.xul in Firefox 1.0.4 on OS X, so it might
be related to
(In reply to comment #7)
> This doesn't seem limited to QueryInterface.
> window.document.location.toString();")()); gives me
> chrome://browser/content/hiddenWindow.xul in Firefox 1.0.4 on OS X
It gives me "about:blank" in Firefox 1.0.4 on Win98.
hiddenWindow.xul is described as Mac OS X thing in this page.
==> [object ChromeWindow]
I'm sorry. I changed Severity by mistake. Blame me...
Marking FIXED now that bug 294795 is fixed.
v.fixed on aviary with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.9)
Gecko/20050706 Firefox/1.0.5 using attached testcase, all checks passed.