376635 - Attacker can trick user into bookmarking a dangerous link

Status: RESOLVED DUPLICATE of bug 249747

(Firefox :: Bookmarks & History, defect)

Description

[Paul Nickerson]

Attachment: double-clicking a link can cause xss

If a user decides to bookmark a link by dragging it to the bookmark toolbar, the dangerous protocol security measures can be circumvented by changing the location pointed to by the link from a valid webpage to a dangerous url.

Example:
<a href="http://google.com" id="mylink" onmousedown="mylink.href='javascript:alert(location)'">drag to bookmark toolbar</a>

This bug can be combined with another bug to cause XSS as shown in the attachment

Comment 1

[:Gavin Sharp [email: [e-mail]]]

This kind of seems like a combination of bug 371179 and bug 249747.

Comment 2

[Paul Nickerson]

Hmm... I could have sworn Firefox on my computer wasn't allowing me to bookmark javascript: or data: urls unless I dynamically changed the href attribute to such an url. Now that I try it, it works.

Oh well. When (if) bug 371179 gets patched, use this bug as a variation test :P