439035 - Same-origin check in nsXMLHttpRequest::OnChannelRedirect() can be circumvented

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

This is fx2-only.  (On trunk, the same-origin check in question compares an old
URI to a new URI.)

The same-origin check in nsXMLHttpRequest::OnChannelRedirect() uses a principal
of an associated JS context.  It can be circumvented by loading a cross-origin
page in that context before nsXMLHttpRequest::OnChannelRedirect() is called.

By using this trick, an attacker can read contents and http headers of a target
site.

Upcoming testcase consists of an html and a cgi script, thus it does not work
on bugzilla.mozilla.org.  Please set up it in a suitable place.

Comment 3

[Johnny Stenback (:jst)]

Jonas, any reason not to just make fx2 do what trunk does here? I.e. just compare the URIs and not bother using the unreliable context pointer here?

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Yup, that's what we should do

Comment 5

[Mike Schroepfer]

Jonas can you work up the patch?

Comment 6

[Johnny Stenback (:jst)]

Attachment: Fix per above comments.

This fixes this bug, verified with local install of the testcase.

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 325799 [details] [diff] [review]
Fix per above comments.

Not sure if we've decided to take more changes for 1.8.1.15, but if we did this would be a good candidate.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 325799 [details] [diff] [review]
Fix per above comments.

Approved for 1.8.1.15 and 1.8.1.16, a=dveditz for release-drivers

Please land on both branches (MOZILLA_1_8_BRANCH for 1.8.1.16 and GECKO181_20080612_RELBRANCH for 1.8.1.15) and give the bug both fixed1.8.1.15 and fixed1.8.1.16 keywords

Comment 9

[Johnny Stenback (:jst)]

Fix landed on both branches.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Verified the bug with Firefox 2.0.0.14 and the fix with the final 2.0.0.15 build (Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.15) Gecko/2008062305 Firefox/2.0.0.15).

Comment 14

[Al Billings [:abillings - ex-MoCo]]

I've verified this, again, with : Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.8.1.16) Gecko/2008070205 Firefox/2.0.0.16. With 2.0.0.14, I get the data from mozilla.com in great detail. This does not happen in 2.0.0.16.

Comment 16

[Samuel Sidler (old account; do not CC)]

Comment on attachment 325799 [details] [diff] [review]
Fix per above comments.

This patch had approval for 1.8.1.16, but apparently the flags got moved out. Clearing that flag to clear the queries.