380476 - XSS by loading a target site in the middle of calling setTimeout()

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

A page load initiated in a function can be processed in the middle of that
function.

  function f() {
    var d = w.document;
    w.location = url;
    w.document == d; // --> true
    alert(1); // or sync XMLHttpRequest, etc.
    w.document == d; // --> false
  }

By using this behavior, an attacker can perform an XSS attack using
setTimeout().  While setTimeout() is being called on a window, at the time of
conversions of arguments, it's possible to load a target site in the window
that setTimeout() is being called on.  When this happens, execution of
setTimeout() continues on the target site.

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1

This works on fx2.0.0.x and fx1.5.0.x.

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2

This works on trunk, fx2.0.0.x and fx1.5.0.x.

Comment 3

[Mike Connor [:mconnor]]

punting remaining a6 bugs to b1, all of these shipped in a5, so we're at least no worse off by doing so.

Comment 4

[Johnny Stenback (:jst)]

Attachment: Don't fire timeouts in windows that are no longer loaded.

Comment 5

[Johnny Stenback (:jst)]

Fix checked in.

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 271138 [details] [diff] [review]
Don't fire timeouts in windows that are no longer loaded.

Does this patch work for 1.8?

Comment 7

[Johnny Stenback (:jst)]

It *should* work, but I haven't ported the patch (assuming that's even needed). Let me know if you want this and I'll test it out etc.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 271138 [details] [diff] [review]
Don't fire timeouts in windows that are no longer loaded.

approved for 1.8.1.5 and 1.8.0.13, a=dveditz for release-drivers

Comment 9

[Johnny Stenback (:jst)]

Fix landed on branches.

Comment 10

[juan becerra [:juanb]]

Verified fixed on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.5) Gecko/2007071317 Firefox/2.0.0.5

Was unable to reproduce the problem on Tbird 15012 or 15013, during Tbird 15013 verifications.