313664 - focusedElement gives untrusted script a reference to the textbox inside a file upload control

Status: RESOLVED INVALID

(Core :: DOM: UI Events & Focus Handling, defect, P3)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b5) Gecko/20051023 Firefox/1.5

Might be related: bug 313573, bug 313566.

Comment 1

[Jesse Ruderman]

Attachment: testcase

To reproduce: click on the textbox in the file upload control.

Result: "Focus is somewhere weird", which I think indicates that the script has a reference to a hidden child of the file upload control.

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

On trunk this is not a problem at all really, there is nothing dangerous you can do with that textbox. Probably worse on branch if we have focusedElement there?

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Would be really good to have this fixed though as we in general try to make it impossible to get to native-anonymous nodes.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

I opened bug 561664 to fix a non-security related part of this.
Is there any reason to keep this as sg:* bug? Or keep this open?

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

For trunk I can't think of any reason to keep this bug hidden, or indeed open. I don't know if we're still supporting any branches where getting to the textbox is bad. I don't think that is the case.

Comment 6

[Johnny Stenback (:jst)]

I say we're done here.