298315 - cross window function callback allows XSS & arbitrary code execution

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[shutdown]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050620 Firefox/1.0+ (2005062006)

A window (window-1) can hold a reference to the JS function closure
created by a page (page-1) which is loaded in another window (window-2).
And window-1 can invoke said JS function after window-2 have loaded
another page (page-2). In such case, said JS function, created by
page-1, is executed in the context of page-2.

Reproducible: Always

Steps to Reproduce:
1. load the testcase.
2. follow the "steps" written in the testcase.
Actual Results:  
the function created by the already unloaded page is
executed in the context of the newly loaded page.

Expected Results:  
such "unloaded" function cannot be executed.

see also: bug 296514, bug 296639

Comment 1

[shutdown]

Attachment: XSS testcase

Works on:
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050620 Firefox/1.0+
(2005062006)

Comment 2

[shutdown]

Attachment: arbitrary code execution testcase

Works on:
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050620 Firefox/1.0+
(2005062006)

Comment 3

[Johnny Stenback (:jst)]

Confirming, and marking blocker.

Comment 4

[Jay Patel [:jay]]

Not making the 1.0.5 train.  Need to retest on the Trunk before landing on the
branches.

Comment 5

[Chris Beard]

closing down for 1.8b3, let's try and get this in for 1.8b4

Comment 6

[Mike Shaver (:shaver emeritus)]

Looks like this was fixed by split-window.  shutdown: can you VERIFY?

Comment 7

[Johnny Stenback (:jst)]

Fixed on the trunk before we branched for 1.8.

Comment 8

[Daniel Veditz [:dveditz]]

Fixed on the aviary1.0/mozilla1.7 branches by the split-window alternative (bug 316589)

Comment 9

[Jay Patel [:jay]]

v.fixed on 1.0.1 Aviary branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060213 Firefox/1.0.8 with both testcases.