390983 - (CVE-2007-5335) addMicrosummaryGenerator sidebar method can install from file URIs in content

Status: RESOLVED FIXED

(Firefox Graveyard :: Microsummaries, defect)

Description

[Ryan Flint [:rflint] (ping via IRC for reviews)]

Attachment: 1.8 patch

From what I can tell, this only opens up another way to get at bug 267645 (making the XHR throw an OOM from loading large files), which can be done through easier paths than this. Filing in sg just because it's late and I may have missed something other than that - if not we should at least close this up to maintain consistency with content policies/other sidebar methods.

I'll fix this on trunk as part of bug 370242.

Comment 1

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 275304 [details] [diff] [review]
1.8 patch

>+    if (!/^https?:\/\//i.test(generatorURL))
>+      return;

Good catch!  The only issue here is that addPanel and addSearchEngine both allow FTP and don't check for the double slash after the colon, i.e.:

    if (!/^(https?:|ftp:)/i.test(url)) {

Seems like we should do the same here.

Comment 2

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 275304 [details] [diff] [review]
1.8 patch

Hrm, ryan points out that the microsummary service doesn't support FTP yet, so this is actually good as is. r=myk

Comment 3

[Ryan Flint [:rflint] (ping via IRC for reviews)]

Attachment: 1.8 patch v2

Pulls out the double slash to match up with the majority of similar checks in the file.

Comment 4

[Myk Melez [:myk] [@mykmelez]]

Comment on attachment 275715 [details] [diff] [review]
1.8 patch v2

Looks good, r=myk

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 275715 [details] [diff] [review]
1.8 patch v2

approved for 1.8.1.7, a=dveditz for release-drivers

Comment 6

[Ryan Flint [:rflint] (ping via IRC for reviews)]

mozilla/browser/components/sidebar/src/nsSidebar.js 1.10.8.13

Comment 7

[juan becerra [:juanb]]

Ryan, can you help us verify this fix in FF 2008rc2? 

Comment 8

[Ryan Flint [:rflint] (ping via IRC for reviews)]

(In reply to comment #7)
> Ryan, can you help us verify this fix in FF 2008rc2? 
> 

Testcase is in the URL field - builds < 2.0.0.8 on windows should open up a dialog to add a microsummary generator and 2.0.0.8 builds should do nothing. I can verify that that is indeed the case in the latest 2.0.0.8 nightly.

Comment 9

[Daniel Veditz [:dveditz]]

verified in 2.0.0.8rc2