309228 - Default prefs for blocking DOMParser in mailnews have a typo

Status: VERIFIED FIXED

(MailNews Core :: Security, defect)

Description

[Jesse Ruderman]

http://lxr.mozilla.org/mozilla/source/modules/libpref/src/init/all.js

285 // Restrictions on the DOM for mail/news - see bugs 66938 and [bug 84545]
286 pref("capability.policy.mailnews.sites", "mailbox: imap: news:");
...
346 pref("capability.policy.mailnews.DOMParser,parseFromString", "noAccess");
347 pref("capability.policy.mailnews.DOMParser,parseFromStream", "noAccess");

Those commas should be periods!  I don't know how bad a security hole this is.

Comment 1

[Jesse Ruderman]

Those prefs were added in bug 152701.  This might not be a security hole,
because I can't think of how you could use DOMParser for a wiretap-style exploit.

Comment 2

[Scott MacGregor]

I can change the commas to a period pretty easily :)

Comment 3

[Scott MacGregor]

Attachment: the fix

Comment 4

[Scott MacGregor]

Comment on attachment 197121 [details] [diff] [review]
the fix

wow bugzilla got messed up here quite badly.

Comment 5

[Jesse Ruderman]

Minimo contains a copy of the mailnews capability prefs.  I think that copy
should either stay in sync, or be removed if it's not used.

Comment 6

[Doug Turner (:dougt)]

i will fix up the all.js for minimo.

Comment 7

[Tracy Walker [:tracy]]

Verified with Mac Thunderbird trunk build 2005-09-23-07-trunk

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 197121 [details] [diff] [review]
the fix

aviary101/moz17 landing approval: a=dveditz for drivers. Please add the fixed1.7.13 and fixed-aviary1.0.8 keywords when landed.

Comment 9

[Tim Riley [:timr]]

dveditz to check in for 1.0.8/1.7.13

Comment 10

[Daniel Veditz [:dveditz]]

Fix checked into aviary101/moz17 branches

Comment 11

[Jay Patel [:jay]]

v.fixed on 1.0.1 Aviary branch by code inspection with LXR: http://lxr.mozilla.org/aviary101branch/source/modules/libpref/src/init/all.js

Comment 12

[Marcia Knous [:marcia]]

verified on the 1.7 branch using inspection: http://lxr.mozilla.org/mozilla1.7/source/modules/libpref/src/init/all.js

Using Mozilla 1.7.13 Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.7.13) Gecko/20060306. Adding keyword.

Comment 13

[Marcia Knous [:marcia]]

Jay verified this fix (Comment 11) on the 1.0.1 aviary branch, so we should okay for Thunderbird 1.0.8.