45877 - Signed script dialog corrupts prefs file.

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[John Taylor]

BuildID:    2000071708

When script run, a dialog appears asking the user to accept or decline the 
signed script. A box asks if the user wants to remember the decision. By 
selecting "remember" the browser writes information about the signed script and 
its capability to the user's pref.js file. The capability is inordinately long 
and contains newlines and quotes. When browser is started with these changes, it 
is unable to read the preferences file.

Reproducible: Always
Steps to Reproduce:
1. Sign attached script and html file
2. run html file in mozilla (make sure "Remember this selection" is checked).
3. quit mozilla
4. restart mozilla

Actual Results:  Unable to access any preferences. Reverts to defaults prefs, so 
unable to check mail, bookmarks, etc without manually changing pref.js file.							

Expected Results:  Should run with user's preferences.

Comment 1

[John Taylor]

Attachment: html file for script

Comment 2

[John Taylor]

Attachment: script which tries to get access and causes problem

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Confirmed exploit.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

This is an exploit which I think will probably be taken advantage of. The fix is 
simple. jataylor believes the bug is caused by an excessively long privilege 
name, not by any odd characters in the name, so simply checking for a maximum 
length on these names will solve the problem. Nominating nsbeta3.

Comment 5

[ekrock's old account (dead)]

[nsbeta3+]. Clearly we must figure out what the maximum safe length for a
privilege is and stick within that. Beyond that (as a more ambitious fix,
probably FUTURE) it might be worth looking at whether the preferences service
should be made more robust so it's less easily hosed.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

->jtaylor. John, I think it would be best to solve this at the root of the 
problem, which may be in prefs or possibly the JS engine. I'll work with you on 
this.

Comment 7

[John Taylor]

Fix checked in.

Comment 8

[cathy zhang]

verified

Comment 9

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.