306658 - Cookies set from about:blank pages have no hostname

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Steps to reproduce:
1. javascript:window.open().document.cookie="this=bad"; void 0
2. Look at your cookies.

Result: there's now a session cookie with no hostname and path "blank".  This
cookie is shared by all about:blank pages, regardless of what page linked to
about:blank.

Expected: ideally, the cookie should be set as if it came from the page that
opened about:blank.  In the short run, I could go for failing.

Comment 1

[Daniel Veditz [:dveditz]]

This is similar to local file cookies having no hostname, but that one's more of
a real problem. about:blank by definition has no content, how are cookies
getting set? If you've added content from some other page it will get the host
of that page. If you've typed in a cookie-setting bookmarklet that's probably an
edge case we don't care about.

Is the security-sensitive flag necessary? I don't see the exploit.

Comment 2

[Jesse Ruderman]

Reproduced with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4)
Gecko/20050901 Firefox/1.0+.

The kinds of attacks I'm worried about:

* Setting a cookie that ends up being sent for all sites.  (If a .mozilla.org
cookie is sent for bugzilla.mozilla.org, does anything prevent a site with no
hostname from setting a cookie that is sent for all sites?)

* Intentional use of cross-site cookies, e.g. by advertisers, that is supposed
to be difficult or impossible.

Comment 3

[Hixie (not reading bugmail)]

Jesse: Is this reproducable without a bookmarklet?

Comment 4

[Jesse Ruderman]

Attachment: testcase

Yes.

Comment 5

[Jesse Ruderman]

It may be possible to exploit this without opening a new window, e.g. using an
iframe.

Comment 6

[Daniel Veditz [:dveditz]]

yes, this can be done using iframes :-(

Comment 7

[Asa Dotzler [:asa]]

Dan's pretty overloaded. Who else can help here. 

Comment 8

[Asa Dotzler [:asa]]

->mconnor.

Comment 9

[Mike Connor [:mconnor]]

Attachment: make CheckDomain actually fail for non-file URIs without a hostname

Comment 10

[[e-mail]]

Comment on attachment 197959 [details] [diff] [review]
make CheckDomain actually fail for non-file URIs without a hostname

looks good. it would be safer to default |isFileURI| to false, but that may
break things... i'll punt that question to someone who knows the failure modes
of SchemeIs. darin?

in any case, r=dwitte.

Comment 11

[Darin Fisher]

Comment on attachment 197959 [details] [diff] [review]
make CheckDomain actually fail for non-file URIs without a hostname

I agree with dwitte.  It is probably best to initialize isFileURI to PR_FALSE.
Also, you could optimize this code further to avoid calling SchemeIs in the
case where hostFromURI.IsEmpty() is false.  I think you should do that:

if (hostFromURI.IsEmpty()) {
  // check SchemeIs...
}

sr=darin

Comment 12

[Mike Connor [:mconnor]]

Fixed branch and trunk.

Comment 13

[Christian :Biesinger (don't email me, ping me on IRC)]

what about jar:file://...?

Comment 14

[Daniel Veditz [:dveditz]]

Comment on attachment 197959 [details] [diff] [review]
make CheckDomain actually fail for non-file URIs without a hostname

a=dveditz for drivers on the aviary101/moz17 branches.

Comment 15

[Daniel Veditz [:dveditz]]

Fix checked into aviary101/moz17 branches

Comment 16

[Marcia Knous [:marcia]]

verified fixed using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060216 Firefox/1.0.8. Cookie fails. adding relevant keyword.

verified fixed using Mozilla 1.7.13 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060216. Cookie fails, adding relevant keyword.