391650 - temporary window spoofing and other oddities

Status: RESOLVED WONTFIX

(Core :: General, defect)

Description

[georgi - hopefully not receiving bugspam]

Attachment: testcase - alert2.html

temporary window spoofing and other oddities

var co="location='http://www.mozilla.org'";
setTimeout(co,80);
alert("wait a little");
morecode;

while the alert is displayed, the new page is loaded in the *same
window*. after hitting ok on the alert, morecode is executed.

morecode can do very little with Window (alert fails),
location='javascript:....' allows temporary window spoofing:
arbitrary non https location
arbitrary content *while* |alert| or |confirm| is displayed

trunk seems safe

maybe more abuse is possible in this situation

Comment 1

[georgi - hopefully not receiving bugspam]

screenshots spoofing m.o and b.m.o
http://www.guninski.com/mozbugs/scr-moz.png
http://www.guninski.com/mozbugs/scr-bugz.png

dveditz, jesse, what [sg:] applies to these spoofs ?

Comment 2

[Jesse Ruderman]

I'd call this a low-severity spoof.  But the 1.8 branch is over now.