309258 - XPath can be used to determine text of mail message (wiretap)

Status: RESOLVED FIXED

(MailNews Core :: Security, defect)

Description

[Jesse Ruderman]

XPath lets you search the document for text nodes containing a given string. 
This is sufficient to determine the rough content of a message through repeated
searches, something we try to prevent (see bug 66938).

Comment 1

[Jesse Ruderman]

Attachment: Demo

You can play with the demo in Firefox, but it's more interesting if you send it
to yourself by email and open it using SeaMonkey.

I tested with SeaMonkey 1.0a and Thunderbird 1.5 Beta 1.  SeaMonkey is
vulnerable.  Thunderbird 1.5 Beta 1 is not vulnerable because XPath is not
compiled (?).  I didn't test older versions.

This testcase isn't very efficient.  I think it can be made more efficient, and
maybe even more direct by using different XPath features.

Comment 2

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

What's special about XPath?  It looks like this example depends on script being
enabled and having access to the DOM document object.  Given that, why not just
walk the DOM structures?  What does this provide that that doesn't?

Comment 3

[Jesse Ruderman]

Many things are disabled, including textnode.data and anything.innerHTML.  See
http://lxr.mozilla.org/mozilla/source/modules/libpref/src/init/all.js#285.

Comment 4

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

That seems like a rather odd security model, and one that many people don't know
about.  Blocking things piece-by-piece doesn't seem like it's going to be
effective -- we'll keep finding more gaps (like this and bug 309276).  We need
to block access to what we don't want the script accessing.

Comment 5

[Jesse Ruderman]

See also bug 309267, "Consider using a whitelist of allowed JavaScript
properties and methods for mailnews".

Comment 6

[Daniel Veditz [:dveditz]]

Not sure how to rate this since javascript is off by default in mail. If it's not in Thunderbird maybe this should be moved to the Mozilla Application Suite product

Comment 7

[Brandon Sterne (:bsterne)]

Fixed by bug 374577.