411093 - XPCNativeWrapper pollution using Function constructor

Status: RESOLVED FIXED

(Core :: XPConnect, defect, P1)

Description

[moz_bug_r_a4]

A function that Function constructor creates inherits its scripted caller's
script filename.  Thus, it's possible to use Function constructor in the same
way as bug 369211 and bug 387881 to modify XPCNativeWrappers.

Comment 1

[moz_bug_r_a4]

Attachment: testcase - Arbitrary code execution

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Just like obj_eval... I'd common the three places that we use this, but don't feel it's worth it.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 296849 [details] [diff] [review]
Fix

Why not common in JS_EvalFramePrincipals, or wrap that with a js_EvalPrincipalsFileAndLine helper?

/be

Comment 4

[Daniel Veditz [:dveditz]]

No tested trunk fix, not going to make 1.8.1.12 either. Would like similar bug 411092 dealt with at the same time.

Comment 5

[Johnny Stenback (:jst)]

Fix checked in per discussion with mrbkap. Marking bug FIXED.

Blake, please open a new bug if you change your mind on the need to deal with comment 3.

Comment 6

[Samuel Sidler (old account; do not CC)]

Blake, will this patch apply cleanly on branch as well? If so, can you please request approval on it? If not, please attach a branch patch.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 296849 [details] [diff] [review]
Fix

This applies with some fuzz.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 296849 [details] [diff] [review]
Fix

approved for 1.8.1.13, a=dveditz for release-drivers

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branch.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Verified fix for 1.8 branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/2008031114 Firefox/2.0.0.13 and bug verified in 2.0.0.12.

Comment 11

[Alexander Sack]

attachment 296849 [details] [diff] [review] applies with some fuzz on 1.8.0 branch.