309276 - Wiretap with splitText and offsetWidth

Status: RESOLVED FIXED

(MailNews Core :: Security, defect)

Description

[Jesse Ruderman]

Using splitText and offsetWidth, scripts in a mail message can determine the
width of each character in a message.  With a little more effort (say, trying
multiple fonts), a script could determine the exact text using the same methods.

For why this is a security hole, see bug 84545.

Based on this example, I think the following should be blocked:
* textnode.splitText - Determine number of characters in text node by checking
for exceptions.
* element.offsetWidth - Determine exact width of a character, etc.
* window.getComputedStyle - for good measure.

Tested using SeaMonkey 1.0 Alpha.

Comment 1

[Jesse Ruderman]

Attachment: Demo

You can play with the demo in Firefox, or send it to yourself in a mail message
and see it in action.

Comment 2

[Daniel Veditz [:dveditz]]

Javascript is off in mail and I don't see us budging from that stance. Do we need to keep this theoretical attack confidential in light of that?

Comment 3

[Brandon Sterne (:bsterne)]

Fixed by bug 374577.