417397 - loadBindingDocument method on XML documents will load arbitrary URIs

Status: VERIFIED DUPLICATE of bug 379959

(Firefox :: General, defect)

Description

[Gregory Fleischer]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12

The loadBindingDocument() method on XML documents will load arbitrary URIs including "file:///".

Currently, there is not an apparent method to get the results back so this is not usable as information leak of arbitrary files.  It may be possible to use the function to load valid XML binding documents and discover directory locations though.


Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Gregory Fleischer]

Attachment: Example that shows loading of file:// URI

Example will attempt to load "/etc/hosts" on Linux and Mac OS X and "C:\boot.ini" on Windows.

Check the JavaScript error console to see parse error.

Comment 2

[Jeff Walden [:Waldo]]

We're on this already in bug 379959, so this particular bug happens to be a dup.  Thanks for the report, tho!