299443 - attachment edit page should not render XUL attachments

Status: RESOLVED DUPLICATE of bug 38862

(Bugzilla :: Attachments & Requests, defect)

Description

[Eyal Rozenberg]

It seems when you upload a XUL attachment, the attachment edit page renders the
XUL, possibly also running any Javascript present within it. Even regardless of
the javascript this could pose a risk.

Comment 1

[Frédéric Buclin]

Is that really a Bugzilla bug or a Firefox/Seamonkey bug??

Comment 2

[Gervase Markham [:gerv]]

It is a Bugzilla bug.

Is there any risk in XUL attachments which is greater than that of HTML attachments?

Gerv

Comment 3

[Eyal Rozenberg]

(In reply to comment #2)
> Is there any risk in XUL attachments which is greater than that of HTML
attachments?

I really can't say... but if javascript attachment shouldn't be allowed to run,
I would think XUL attachment shouldn't either. Plus maybe som more privileged
actions can be performed through XUL that I'm not aware of.

Comment 4

[Gervase Markham [:gerv]]

Eyal: unless there's a bug in Gecko, remote XUL should not have any more
privileges than remote HTML.

Yes, there is a long-standing problem here, primarily related to
cookie-stealing. We are working on how to fix it, but it's not trivial.

Gerv

*** This bug has been marked as a duplicate of 38862 ***

Comment 5

[Max Kanat-Alexander]

This bug is being removed from the security group because the bug that it is a duplicate of is now public, since it has been fixed and a Security Advisory has been sent about it. See bug 468249 for the Security Advisory.