305473 - [FeedView] RSS icon can load javascript: URLs

Status: RESOLVED INVALID

(Firefox Graveyard :: RSS Discovery and Preview, defect)

Description

[Jesse Ruderman]

The RSS icon can load javascript: URLs.  It should block javascript: and data:
URLs (because it's hard to get the privileges on those right), and it should
call CheckLoadURI to avoid loading chrome:// and file:// URLs when it shouldn't.

Comment 1

[Jesse Ruderman]

Attachment: testcase that combines this and bug 305472

Comment 2

[Jesse Ruderman]

Click the RSS icon in the testcase to see your cookie stolen by a script from
http://www.squarefree.com/.  The testcase relies on bug 305472 in addition to
relying on this bug.

Comment 3

[Jesse Ruderman]

On the Gecko 1.8 branch, which doesn't have FeedView any more, it is possible to
make a live bookmark for a javascript: URL.  I don't think this is a security
hole on the branch, though.

Comment 4

[Daniel Veditz [:dveditz]]

This is back? 
http://www.mozilla.org/security/announce/mfsa2005-12.html (bug 265668)

Gah!

Doesn't seem to ever run the javascript url, though. Is this what you mean by "I
don't think this is a security hole"?

Comment 5

[Jesse Ruderman]

I don't remember what I meant, but that would make sense.

Comment 6

[Jesse Ruderman]

FeedView is gone on trunk too.

Comment 7

[Jesse Ruderman]

Invalid because FeedView was removed.  I'll file a new bug for the remaining
issue instead of morphing this bug.

Comment 8

[Jesse Ruderman]

Filed bug 312108 for the remaining issue, "RSS icon can add javascript: URLs as
live bookmarks".

Comment 9

[Tanner M. Young [:tmyoung]]

Resetting QA Contact to default.