309267 - Consider using a whitelist of allowed JavaScript properties and methods for mailnews

Status: RESOLVED FIXED

(MailNews Core :: Security, enhancement)

Description

[Jesse Ruderman]

The blacklist of properties and methods for mail messages is large and hard to
get right.  See most of bug 84545's dependencies for things that were omitted at
one time or another.

What kinds of things do scripts in mail do, and what properties and methods do
they usually use?  What would a whitelist have to look like to allow, say, 90%
of legitimate JavaScript-containing messages work?

Comment 1

[Daniel Veditz [:dveditz]]

> The blacklist...is large and hard to get right.

Isn't this why we (and Microsoft) simply turned off Javascript in mail?

> legitimate JavaScript-containing messages

What does one of those do? How do you allow any "legitimate" javascript while preventing at the very least a mail-based DOS? With Javascript turned on even if all "wiretap" and "DOS" holes are closed (magically) mail could still be an avenue for most of the exploits the browser has had.

In the browser the user has to stumble across the bad guys (and that's easy enough); the sad history of the anti-spam fight shows there's no way to stop the bad guys from coming to you in mail.

Comment 2

[Daniel Veditz [:dveditz]]

Mail no longer supports javascript (see bug 374577)