346665 - Arbitrary code execution with Venkman JavaScript Debugger by using document.open or document.write

Status: RESOLVED FIXED

(Other Applications Graveyard :: Venkman JS Debugger, defect)

Description

[moz_bug_r_a4]

See also bug 345305.

When document.open, or document.write on a document that has finished loading,
is called by a script in a different security context, the document's principal
is set to the caller's principal.  In such case, if there are references to
objects/functions that were created in that document's context, then the
references also get the caller's principal.  This can be used to escalate
privilege in a similar way to bug 345305.

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1 - using document.open

This does not work with the proposed patch in bug 344495 applied.

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2 - using document.write

Comment 3

[James Ross]

There's more to this than just Venkman, as even with my temporary patch for bug 345305 it still has the stack, even though the alert is from the webpage and not Venkman itself (meaning the code was running in the webpage context).

Is this really just bug 345305 + bug 346659? If there's nothing new from either of them, I don't think we need a bug specifically for it, though the testcases are useful.

Comment 4

[James Ross]

With my patch in bug 345305 (on current trunk), I see no alerts at all with either testcase; both set the throbber going, and the security icon goes into the "broken" state, but that's it.

Comment 5

[moz_bug_r_a4]

I think that this bug is fixed.  Please see bug 346663 comment #4 and #5.

Comment 6

[Justin Dolske [:Dolske]]

Marking FIXED based on last comment (as with bug 346664).