51442 - JS in mail/news running with system principal

Status: VERIFIED FIXED

(Core :: Security, defect, P1)

Description

[Mitchell Stoltz (not reading bugmail)]

This is really bad. Not only is the "Disable JS in mail/news" pref not working, 
scripts in mail are actually running with the all-powerful system principal. This 
needs to be fixed immediately.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Suggest nsbeta3+ as this is serious. I'll try to track it down, but I'll probably 
need help from mailnews.

Comment 2

[Scott MacGregor]

I'm willing to help. How would JS get the system principal? Here's how we create
that iframe in messenger.xul:
<iframe id="messagepane" context="messagePaneContext" style="height: 0px"
flex="1" name="messagepane" type="content-primary" src="about:blank"/>

When JS runs inside this iframe, how does the security code figure out that this
iframe should get the system principal?

Why is it treated any different than any other ol' iframe?

Comment 3

[Scott MacGregor]

Oh I see the trouble maker....oh dear. in nsStreamConverter.cpp around line 596,
libmime gets the system principal and assigns it as the owner on the channel we
are using for displaying the message.

Could this be how it's sneaking in? In any case, that snippet scares me a bit.

cc'ing rhp, the author of that code. 

Comment 4

[Scott MacGregor]

Attachment: proposed fix

Comment 5

[Scott MacGregor]

Here's my proposed fix. nsStreamConverter was setting the system principal on
the channel being used to load content into the message pane iframe. I just took
this code out.

Rich, do you know why we needed to do that? I'm not seeing any side effects by
taking these lines out.

Comment 6

[rhp (gone)]

My gut feel is that this was a copy and paste issue. When I got the code to 
dork around with the channel's, I might have copied this stuff as well. Just a 
thought, but the change looks good to me. r: rhp

- rhp

Comment 7

[Scott MacGregor]

per triage mtg.

Just for PDT's sake, the consequences of this are that arbitrary JS in email
messages have access to XP-Connect among other things and can do all sorts of
nasty things. 

Comment 8

[Mitchell Stoltz (not reading bugmail)]

This fix works for me. Scott, can you get this checked in?

Comment 9

[Scott MacGregor]

You bet. Thanks for the review Rich!

Comment 10

[Scott MacGregor]

Fixed.

Comment 11

[Paul Wyskoczka]

John could you verify this bug - Thanks
Changing QA contact to [e-mail]

Comment 12

[John Unruh]

Verified on 9/6 Win95 and Linux.

Comment 13

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.