412462 - Cross origin wrapper's convert hook allows for XSS

Status: RESOLVED FIXED

(Core :: XPConnect, defect, P1)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: testcase

There's a comment:
  // TODO wrap return value?
but we don't do that, so you can get your hands on a plain outer window object and navigate that window to another origin and access properties. Currently, you cannot access "native" properties thanks to the security check in XPCWrappedNative::CallMethod, but jst (and I) want to do away with that. Fix coming up.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Note that at the bottom of the function, rv is the result of IsWrapperSameOrigin.

Brendan, any other convert gotchas you can think of?

Comment 2

[Brendan Eich [:brendan]]

Comment on attachment 297196 [details] [diff] [review]
Fix

Could JSTYPE_FUNCTION be passed in as type? See jsinterp.c and jsfun.c, grepping for 'convert.*JSTYPE_FUN'.

/be

Comment 3

[Johnny Stenback (:jst)]

Fix checked in per discussion with mrbkap. Blake, please reopen or file a new bug if you change your mind about the need to deal with comment 2. Marking FIXED.