514435 - Bypassing XOW by using SJOW

Status: RESOLVED FIXED

(Core :: XPConnect, defect, P1)

Description

[moz_bug_r_a4]

When SJOW code wraps a same-origin XOW, it unwraps the XOW.  And, when SJOW
code calls an untrusted function, it unwraps arguments that are SJOWs.  Thus,
it's possible to bypass XOW.

Comment 1

[moz_bug_r_a4]

Attachment: testcase

This tries to get cookies for www.mozilla.com.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

This fixes the bug by not unwrapping XOWs when wrapping in a SJOW. I also had to fix enumeration in that case because we end up walking the wrong prototype chain to find prototype properties of the XOW (the XOW doesn't even have a prototype at all).

Comment 3

[Johnny Stenback (:jst)]

Comment on attachment 403541 [details] [diff] [review]
Fix

- In XPC_SJOW_Iterator():

+  JSObject *tmp = XPCWrapper::UnwrapGeneric(cx, &sXPC_XOW_JSClass, unsafeObj);
+  if (tmp) {
+    unsafeObj = tmp;

Maybe only do this assignment if we pass the following if check?

r=jst

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/70475458eabb

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Can this land on mozilla-1.9.2? It blocks the beta of Firefox 3.6 ...

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/959c68135911

Comment 7

[Samuel Sidler (old account; do not CC)]

Blake: We need a port of this for 1.9.1.5 and 1.9.0.16.

Comment 8

[Samuel Sidler (old account; do not CC)]

Blake: Where are you on a branch port here? Code freeze is November 10 at 11:59pm.

Comment 9

[Samuel Sidler (old account; do not CC)]

Nevermind, I see bug 520522 and bug 524994.

Comment 10

[Mike Beltzner [:beltzner, not reading bugmail]]

What's the status of this and the other two related bugs? I see this one's got sr, one needs a patch and one needs review. They all need to land together, right?

Comment 11

[Mike Beltzner [:beltzner, not reading bugmail]]

Please to be answering comment 10!

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Once the blocking bugs land on trunk (hopefully tomorrow), I'll be able to backport them to older branches.

Comment 13

[Mike Beltzner [:beltzner, not reading bugmail]]

Have they landed? Where are we on this?