331942 - ObjectPrincipalFinder is not registered with the sandbox's context

Status: RESOLVED WORKSFORME

(Core :: XPConnect, defect)

Description

[moz_bug_r_a4]

In 1.0.x, the sandbox's context's findObjectPrincipals is null, thus,
js_CheckPrincipalsAccess always returns JS_TRUE.  This means that the
belt-and-braces don't work as intended in the sandbox.

Comment 1

[moz_bug_r_a4]

Attachment: testcase - Malicious PAC script using the Function constructor retrieved from BackstagePass

Steps to Reproduce:
1. Setup a PAC file testcase on web server, or save it to local hard disk.
2. Set Automatic proxy configuration URL to its URL.
3. Open any web site.

An alert dialog that shows Components.stack will appear.

Also, see Bug 311025.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Hack

This is ugly as sin, but it fixes the bug and there's no obvious way to share the code between the two modules. This is not on a performance-critical path and I'm not sure I care to find a better way to share the code.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Also, I'm not sure if this bug alone is worth respinning for. There are other methods of attack, and I'm not sure how much we do or don't trust the code being compiled from PAC.

Comment 4

[Mike Shaver (:shaver emeritus)]

FWIW, my opinion is that a PAC-requiring vuln is not worthy of a respin; PAC has always been able to do some pretty ugly things if it were hostile.  (Though the sandboxing *is* there for a reason, and we should try to make it live up to its promise.)

Comment 5

[Daniel Veditz [:dveditz]]

Bug 321101 is a similar PAC privilege escalation, but not ready to land. Probably not respinning just for this if we're leaving the other open, but if we have to respin 1.0.8/1.7.13 for bug 331943 then maybe we should take this too.

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 216508 [details] [diff] [review]
Hack

r=dveditz

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 216508 [details] [diff] [review]
Hack

sr=jst

Comment 8

[Tim Riley [:timr]]

After discussions with Schrep, dveditz, mrbkap, darin we decided that we have it is not critical to add this bug to 1.0.8/1.7.13.  There is at least one other similar bug we already passed on for these releases. We plan to crack open the build for bug 33194.  But we want to keep that, yet another respin, *extremely* limited.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Since this only affects the old branches, I'm not going to own this bug any more. If someone wants this patch (which should apply cleanly) on the 1.7 branches, then they'll have to check it in.

Comment 10

[Daniel Veditz [:dveditz]]

Actually this was fixed long ago so "worksforme" is a better resolution. "Wontfix" applies to fixing this on the 1.7 branch which is ancient and unused.