327063 - nsXFormsUtils::CheckSameOrigin should use the principal's URI, not the document's

Status: RESOLVED FIXED

(Core Graveyard :: XForms, defect)

Description

[Boris Zbarsky [:bzbarsky]]

When doing security checks, you want to use the URI (or domain? not sure; no one's ever clearly explained the difference to me) from the principal, not the document's URI.  nsXFormsUtils::CheckSameOrigin passes the document URI as the URI to the permission manager, however.

This can definitely lead to things not getting the permissions they should (eg with data: URIs).

It can also lead to privilege escalation once we have non-principals in place.

Comment 1

[Doron Rosenberg (IBM)]

Attachment: like this?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 211786 [details] [diff] [review]
like this?

Like I said, I don't know whether you want GetURI or GetDomain.  I suggest asking someone who knows the difference (caillon? dveditz?) for review.

Comment 3

[Doron Rosenberg (IBM)]

Comment on attachment 211786 [details] [diff] [review]
like this?

is this really a security issue though?

Comment 4

[Boris Zbarsky [:bzbarsky]]

If it's not one now (which is possible, I guess), it sure will be one once bug 326506 lands!

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 211786 [details] [diff] [review]
like this?

r=dveditz
Yeah, this is what we want.

Comment 6

[Doron Rosenberg (IBM)]

checked into trunk

Comment 7

[Doron Rosenberg (IBM)]

Fixed on 1.8 branch.  Does this need to go into 1.8.0?

Comment 8

[Mike Kaply [:mkaply]]

Comment on attachment 211786 [details] [diff] [review]
like this?

a=mkaply

Comment 9

[Daniel Veditz [:dveditz]]

I don't believe this was a security issue absent changes that haven't yet happened. What might happen with a non-http/ftp base URL is that there will be no host part, so the Permission Manager should not have an "approval" entry for it. The failure mode would seem to be that we'll block valid connections (data urls would appear to have no host) and not allowing connections we shouldn't.