44013 - BUG: spoofing bookmarks using location.__defineGetter__

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Mitchell Stoltz (not reading bugmail)]

It is possible to mislead the user that he is bookmarking a web page,
while the location may be arbitrary, including chrome: and file: urls.
This is dangerous because allows opening local html files and chrome:
urls.
JS in chrome seems to trust too much JS values from BOM, but they may be
redefined using __defineGetter__.

The code is:
-------------------------
Bookmark this page, then choose the bookmark
<SCRIPT>
location.__defineGetter__("href",function() {return
"chrome://navigator/content"});
</SCRIPT>
-------------------------

Comment 1

[Mitchell Stoltz (not reading bugmail)]

__defineGetter__ (and probably also __proto__ and other __ functions) need
security checks to keep them from being used cross-site. ->Brendan.

Comment 2

[Brendan Eich [:brendan]]

Roger, can you take this one -- it's easy and it falls in code you originated 
(obj_defineGetter and obj_defineSetter simply need to check

    /*
     * Getters and setters are just like watchpoints from an access
     * control point of view.
     */
    if (!OBJ_CHECK_ACCESS(cx, obj, id, JSACC_WATCH, &rval, &attrs))
        return JS_FALSE;

with dummy jsval rval; uintN attrs, just before the return OBJ_DEFINE_PROPERTY 
call at the bottom).

I'm marking nsbeta2 to avoid a security firedrill.

/be

Comment 3

[rogerl (gone)]

Attachment: Added access checking code

Comment 4

[Brendan Eich [:brendan]]

Looks good, thanks.  Nits: fval,tval is a bit crowded in the declaration -- how 
about a space after the comma?  And junk is the traditional name (it's not a 
well known tradition ;-) for unused jsval args passed by reference. r=brendan.

/be

Comment 5

[rogerl (gone)]

Fix checked in.

Comment 6

[cathy zhang]

verified

Comment 7

[Brendan Eich [:brendan]]

*** Bug 36948 has been marked as a duplicate of this bug. ***

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.