377356 - Security checks in nsEventReceiverSH::AddEventListenerHelper can be circumvented

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[moz_bug_r_a4]

Please see bug 376987.

Security checks in nsEventReceiverSH::AddEventListenerHelper can be
circumvented in the following way.

  <iframe src="target site"/>
  function X() {}
  X.prototype = frames[0];
  var x = new X();
  addEventListener.call(x, ...);

Comment 1

[moz_bug_r_a4]

Attachment: testcase

This tries to get cookies for www.mozilla.com.

Comment 2

[Johnny Stenback (:jst)]

Attachment: Do the security checks against the right object.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 261730 [details] [diff] [review]
Do the security checks against the right object.

Fun....

Comment 4

[Johnny Stenback (:jst)]

Fixed on trunk.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 261730 [details] [diff] [review]
Do the security checks against the right object.

approved for 1.8.0.12 and 1.8.1.4, a=dveditz for release-drivers

Comment 6

[Samuel Sidler (old account; do not CC)]

Verified on the branches and trunk using the following builds:

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.0.12pre) Gecko/20070430 Firefox/1.5.0.12pre

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.4) Gecko/20070501 Firefox/2.0.0.4

Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a5pre) Gecko/20070428 Minefield/3.0a5pre