306092 - SVG security review: onload event firing

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Jesse Ruderman]

T Rowley mentioned that this is part of the SVG attack surface and could do with
a security review:

  * onload event firing

http://lxr.mozilla.org/mozilla/source/content/xml/document/src/nsXMLContentSink.cpp#1007

Comment 1

[Johnny Stenback (:jst)]

I don't see any potential security problems with that code. We'll be firing
onload events, but they'll be running in the right context et al so any code
that runs should run with the right principals etc. AFAICT this is not a problem
from a security point of view.

Comment 2

[Jesse Ruderman]

Thanks jst.