368858 - Need to sanitize event dialog URL field to prevent script insertion

Status: VERIFIED FIXED

(Calendar :: Security, defect)

Description

[Matthew (lilmatt) Willis]

Currently, you can put "javascript:alert('foo');" in the visit URL field.
With Ln/Fx it will show an alert.  It's not clear if this is exploitable in Ln/Tb or Sb.

We should sanitize the URLs so that only http:// or https:// URLs are permitted to be entered or launched.

Comment 1

[Matthew (lilmatt) Willis]

Attachment: Only passes http[s] urls to the browser

Comment 2

[Dan Mosedale (:dmosedale, :dmose)]

Comment on attachment 253501 [details] [diff] [review]
Only passes http[s] urls to the browser

My understanding of dveditz' comments in person were that he gives an r+ for this.  r2+ with an added XXX comment that we probably want to someday do this using the nsIURI parser instead of by hand (as suggested by dveditz :).

Comment 3

[Matthew (lilmatt) Willis]

Patch with nits checked in on:
  SUNBIRD_0_3_BRANCH
  LIGHTNING_0_3_BRANCH
  MOZILLA_1_8_BRANCH
  trunk

-> FIXED

Comment 4

[Daniel Veditz [:dveditz]]

yeah, r=me, but not hand-parsing would be better. Seems safe enough in this case.

Comment 5

[Martin Schröder [:mschroeder]]

VERIFIED with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.4pre) Gecko/20070406 Calendar/0.5pre.

Message in error console:
Error: launchBrowser: Invalid URL provided: javascript:alert('foo'); Only http:// and https:// URLs are valid.
Source File: chrome://calendar/content/applicationUtil.js
Line: 88