453526 - (CVE-2008-5504) Remaining attack vectors in feed preview on 1.8 branch

Status: VERIFIED FIXED

(Firefox Graveyard :: RSS Discovery and Preview, defect, P1)

Description

[:Gavin Sharp [email: [e-mail]]]

See bug 360529 comment 68 and bug 360529 comment 69.

Comment 2

[Daniel Veditz [:dveditz]]

  -------  Comment #68 From  [e-mail]   2008-09-03 05:11:44 PDT   
There are two oversight.  fx2.0.0.17 is still exploitable.

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/browser/components/feeds/src/FeedWriter.js&rev=1.2.2.36&mark=635#623
This is exploitable.  I'll attach a testcase.

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/browser/components/feeds/src/FeedWriter.js&rev=1.2.2.36&mark=404,406#397
I think this is unsafe.  But, I cannot create a testcase since I don't know a
way to execute this catch block.

------- Comment #69 From [e-mail] 2008-09-03 05:14:55 PDT (-)

Created an attachment (id=336641) [attachment 336713 [details] in this bug --dveditz]
testcase 9 - handlers[0].doCommand()

This works on fx2.0.0.17-candidate-build2 (2008082909).

This uses bug 451680's XSS trick.

Comment 3

[Samuel Sidler (old account; do not CC)]

Mano, any update here?

Comment 4

[Samuel Sidler (old account; do not CC)]

Mano, have you had time to work on this? I'd hate to miss this for a third release in a row, especially since it's the last Firefox 2 release...

Comment 5

[Samuel Sidler (old account; do not CC)]

Mano, please attach a 1.8 patch for this. Code freeze is on Monday.

Comment 6

[Asaf Romano (gone)]

Attachment: patch

See bug 388207, I didn't remove the element from subscribe.xhtml for the sake of backwards-compatibly.

Comment 7

[Mike Connor [:mconnor]]

Comment on attachment 348427 [details] [diff] [review]
patch

Looks good.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 348427 [details] [diff] [review]
patch

Approved for 1.8.1.19, a=dveditz for release-drivers

Comment 9

[Samuel Sidler (old account; do not CC)]

Can we get this landed asap? Code freeze was technically last night...

Comment 10

[Asaf Romano (gone)]

Checking in browser/components/feeds/src/FeedWriter.js;
/cvsroot/mozilla/browser/components/feeds/src/FeedWriter.js,v  <--  FeedWriter.js
new revision: 1.2.2.37; previous revision: 1.2.2.36
done

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Verified with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.19pre) Gecko/2008112503 BonEcho/2.0.0.19pre.

Comment 12

[Alexander Sack]

not an issue on 1.8.0