460001 - XSS by using two event listeners

Status: VERIFIED FIXED

(Core :: Security, defect, P1)

Description

[moz_bug_r_a4]

This is a trunk-only regression from bug 458202.

If there are two event listeners, and the first listener loads a new document,
the second listener can be called on the new document.

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1 - event target is a document

This tries to get cookies for www.mozilla.com.
This works on trunk.

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2 - event target is an XMLHttpRequest object

This tries to get cookies for www.mozilla.com.
This works on trunk.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

bah.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: backout the problematic part of bug 458202

What can I say - my mistake!

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 343204 [details] [diff] [review]
backout the problematic part of bug 458202

It'd be good to get tests on this.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #5)
> (From update of attachment 343204 [details] [diff] [review])
> It'd be good to get tests on this.
Sure, after ff3.0.4 and ff3.1b2.

Comment 7

[Benjamin Smedberg]

http://hg.mozilla.org/mozilla-central/rev/4ebb5707950e was prior to branching.

Smaug, it would be very helpful if you listed changeset IDs or links when marking bugs FIXED.

Comment 8

[u279076]

From a visual point of view, what is the expected result of running these test cases?

Comment 9

[moz_bug_r_a4]

The expected result is no XSS alerts.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1pre) Gecko/20090526
Shiretoko/3.5pre -> XSS alerts do not appear.

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1b2pre) Gecko/20081018
Minefield/3.1b2pre -> XSS alerts appear.

Comment 10

[u279076]

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1pre) Gecko/20090527 Shiretoko/3.5pre

Verified that no XSS alerts appear.