423375 - Content script can load restricted URIs

Status: VERIFIED FIXED

(Core :: Security, defect, P1)

Description

[moz_bug_r_a4]

Content script can load restricted URIs (chrome:, resource:, etc.).  Is this a
regression from bug 246699?

regression range:
http://bonsai.mozilla.org/cvsquery.cgi?module=PhoenixTinderbox&date=explicit&mindate=2008-03-11+09&maxdate=2008-03-12+05

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1

Comment 3

[Al Billings [:abillings - ex-MoCo]]

Is this a blocker, Dan? This looks bad.

Comment 4

[Al Billings [:abillings - ex-MoCo]]

I've verified that this is trunk only and doesn't repro in branch. (It's good to be sure...)

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Should we back out the patch for bug 246699?

Comment 6

[Mike Shaver (:shaver emeritus)]

Yes, please back it that patch out immediately.  I don't have a tree right now, but if nobody else gets it before I get to the office I'll do it.

Comment 7

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #6)
> Yes, please back it that patch out immediately.

done

Comment 8

[Boris Zbarsky [:bzbarsky]]

Please make sure to get those testcases into our automated tests so that no one can ever break this again!

I would suggest removing the security flag, since this is now fixed and was never a problem on branches.

Comment 9

[moz_bug_r_a4]

Just for the record, testcase 2 should be marked as private (it reveals bug
422025's XSS trick).

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #7)
> (In reply to comment #6)
> > Yes, please back it that patch out immediately.
> 
> done
So this is now fixed, right?

Comment 11

[Mike Shaver (:shaver emeritus)]

Yep, and I'm adding the first test case as a mochitest after lunch, to precede any other attempts to touch that code.

Comment 12

[Mike Shaver (:shaver emeritus)]

The mochitest is over in bug 246699, btw.

Comment 13

[Carsten Book [:Tomcat]]

verified fixed using the testcases and Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9pre) Gecko/2008042705 Minefield/3.0pre ID:2008042705

when i use also the 2nd testcase i get "Error: Access to 'chrome://browser/content/browser.xul' from script denied
Source File: https://bugzilla.mozilla.org/attachment.cgi?id=309874
Line: 20" in the Error Console and i think this is also expected

-> Verified fixed