503226 - (CVE-2009-3375) document.getSelection() can read cross-origin content selections

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Gregory Fleischer]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.11) Gecko/2009060214 Firefox/3.0.11
Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.1pre) Gecko/20090708 Shiretoko/3.5.1pre

The document.getSelection() method can be used to read cross-origin content selections.

By storing a reference to the contentDocument of an iframe, any selections made within that iframe can be read regardless of origin.

This method appears to be deprecated.


Reproducible: Always

Comment 1

[Gregory Fleischer]

Attachment: example of reading cross-origin selections

Select destination for iframe and select 'go'.  Make a text selection and the content should be displayed in an alert box.

Comment 2

[Johnathan Nightingale [:johnath]]

The test shows the reported behaviour.  I suspect this should live in Content-land, particularly since jst wrote the deprecation message.  :)

Comment 5

[Johnny Stenback (:jst)]

Marking this a blocker since this allows cross site data leakage.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

Attachment: simple patch

Comment 7

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 394093 [details] [diff] [review]
simple patch

AFAIK, security bugs need separate r and sr nowadays.

Comment 8

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 394093 [details] [diff] [review]
simple patch

mochitest?

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Don't want to add such before this is fixed everywhere.

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/0aa2596a20cc

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/015c3c8cf077

Comment 12

[Daniel Veditz [:dveditz]]

Comment on attachment 394093 [details] [diff] [review]
simple patch

Approved for 1.9.1.4 and 1.9.0.15, a=dveditz for release-drivers

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Checking in content/html/document/src/nsHTMLDocument.cpp;
/cvsroot/mozilla/content/html/document/src/nsHTMLDocument.cpp,v  <--  nsHTMLDocument.cpp
new revision: 3.792; previous revision: 3.791

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/bffd0a33d902

Comment 14

[Al Billings [:abillings - ex-MoCo]]

Verified attached testcase reproduces bug in 1.9.1.3 and is fixed in the 1.9.1.4pre build (Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.4pre) Gecko/20090914 Shiretoko/3.5.4pre).

Comment 15

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.9.0.15 as well with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.15pre) Gecko/2009091606 GranParadiso/3.0.15pre (.NET CLR 3.5.30729).

Comment 16

[Daniel Veditz [:dveditz]]

(In reply to comment #9)
> Don't want to add such before this is fixed everywhere.

I can has test plz?