29541 - links on Excite quote page give a security error

Status: VERIFIED FIXED

(Core :: Security: CAPS, defect, P3)

Description

[Alec Flett]

Go to http://www.excite.com/ and look up a stock quote

Now try to click on one of the links on the left of the quoting area, such as
"News" or "Insider trading"

You'll get this error on the console:
JavaScript Error: access disallowed from scripts at http://live.excite.com to
documents at another domain

JavaScript Error: uncaught exception: [Exception... "Access to property denied"
code: "1010" nsresult: "0x805303f2 (NS_ERROR_DOM_PROP_ACCESS_DENIED)"  location:
"<unknown>"]

the JS link looks like this (at least as it's displayed in the status bar:
javascript:function go()
{location.href='../quotes/?symbol='+escape(document.symbol_entry.symbol.value)+'&whereis=1';}
go();

Comment 1

[Alec Flett]

nominate for beta - I'll bet this has to do with using ".." with the DOM, which
I'm guessing many other sites use.

Comment 2

[Norris Boyd]

The problem was that checking the quote loads a page that is then redirected to 
a site with a different origin. When we go to perform the check, we still are 
using the origin from before the redirect. So we get errors in some cases like 
this, and there is an exploitable security hole otherwise.

I have a fix and will attach a diff.

Comment 3

[Norris Boyd]

Attachment: Proposed patch

Comment 4

[Norris Boyd]

The attached patch just allows the WebShell to be notified when a redirect 
occurs, at which point it updates its local copy of what the current URI is.

Comment 5

[leger]

Putting on PDT+ radar for beta1.  

Comment 6

[Jim Roskind]

Can you update the status whiteboard with a landing date?  We're trying to plot
our path to beta... and we need the date info.

Thanks,
Jim

Comment 7

[Norris Boyd]

After talking with travis, I'm off looking at another way of fixing this problem 
that will work better with the webshell redesign. ETA is hazy.

Comment 8

[Norris Boyd]

Fix with version 1.29 of nsDocShell.h and version 1.410 of nsWebShell.cpp

Comment 9

[John Unruh]

Verified fixed.