Closed Bug 362480 Opened 18 years ago Closed 18 years ago

del.icio.us Bookmarks extension evals JSON data in chrome context

Categories

(addons.mozilla.org Graveyard :: Administration, defect)

Product:
addons.mozilla.org Graveyard
Component:
Administration
Type:
defect
Priority:
Not set
Severity:
major

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: jwkbugzilla, Unassigned)

References

(
URL
)

Details

del.icio.us Bookmarks uses JSON to communicate with the server. Looking at ssrDelicious.js it eval's the results received in privileged context without doing any checks. Another instance of the same pattern is in ybookmarksOverlay, handling of ybookmark.serverError. Interestingly enough, the extension also contains the file json.js with the correct parseJSON function.
Summary: del.icio.us Bookmarks extension executes remote code → del.icio.us Bookmarks extension evals JSON data in chrome context
They fixed this in the update immediately following this report, we're all good here. Thanks for the report, Wladimir.
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → FIXED
Component: Add-ons → Administration
QA Contact: add-ons → administration
Product: addons.mozilla.org → addons.mozilla.org Graveyard
You need to log in before you can comment on or make changes to this bug.