353117 - A part of the fix for bug 352124 can be circumvented

Status: RESOLVED FIXED

(Firefox Graveyard :: RSS Discovery and Preview, defect, P1)

Description

[moz_bug_r_a4]

1. Load a feed page in another window (W).
2. Create a FeedWiter object (F).
3. Call F.write(W).

From here on, F._window is W.  Thus, |if (!this._window)| test in handleEvent
method cannot block an exploit.

  frames[0].location = "feed url";
  f = new BrowserFeedWriter();
  try { f.write(frames[0]); } catch (e) {}
  f.QueryInterface(Components.interfaces.nsIDOMEventListener)
   .handleEvent(untrusted_object);

Comment 2

[Asaf Romano (gone)]

Attachment: patch

Comment 3

[Asaf Romano (gone)]

Attachment: patch

Actually, for the Observe method, the subject in the normal case is expected to be null, and we do use it. Also, content can pass a dom element here anyway, so |this._window| is the preferable check since then we would access the document of  a window which was considered safe for the write method.

Comment 4

[Mike Connor [:mconnor]]

Comment on attachment 238986 [details] [diff] [review]
patch

ok, looks good from here, but let's get jst to SR as time is short.

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 238986 [details] [diff] [review]
patch

sr=jst

Comment 6

[Mike Connor [:mconnor]]

Comment on attachment 238986 [details] [diff] [review]
patch

a=mconnor on behalf of drivers for 1.8 branch checkin

Comment 7

[Asaf Romano (gone)]

1.8:
mozilla/browser/components/feeds/src/FeedWriter.js 1.2.2.23

Comment 8

[Asaf Romano (gone)]

trunk: mozilla/browser/components/feeds/src/FeedWriter.js 1.19