408639 - XPCCrossOriginWrapper calls untrusted functions during construction

Status: RESOLVED FIXED

(Core :: XPConnect, defect, P2)

Description

[moz_bug_r_a4]

XPCCrossOriginWrapper has the same problem as XPCNativeWrapper (bug 407289).

An attacker can perform an XSS attack against a web page that accesses
top.location, etc.

Also, an attacker can run arbitrary code with chrome privileges, since even
when chrome accesses content via XPCNativeWrapper, XPCCrossOriginWrapper can be
created internally.

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1 - XSS

This tries to get cookies for www.google.com.
This uses bug 344495's trick.
This works on trunk.

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2 - arbitrary code execution

This uses bug 344495's trick.
This works on trunk.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Simple fix

This is the easiest way to fix the bug: always just use the currently running script as a scope to figure out what prototype to use (note: it doesn't matter, we null out the prototype later anyway). The actual problem is that we are trying to stash the document's wrapper on the window at an inopportune time. Fixing that is "hard," however, so I went with this.

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 294515 [details] [diff] [review]
Simple fix

A note in a comment here would be good (i.e. update the comment talking about severing the prototype link etc). r=jst

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

I added a comment above the JS_NewObject call that says:

  // Note that  we create outerObj with a null parent here. We set it
  // later so that we find our nominal prototype in the same scope as
  // the one that is calling us.

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 294515 [details] [diff] [review]
Simple fix

How about adding a "FIXME: bug 408871" comment and sr=me?

/be

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Updated to comments

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked in.