535072 - cssText decompiles properties without escaping correctly

Status: RESOLVED FIXED

(Core :: DOM: CSS Object Model, defect)

Description

[Eduardo Vela N]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 GTB6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 GTB6

cssText is not decompiling and escaping the properties it holds.. that may be (is.. actually.. I'll tell the vendor's name when they fix it) a security vulnerability if the server is applying content dynamically.

Reproducible: Always

Steps to Reproduce:
1. Execute the test case
2. ??
3. Profit!
Actual Results:  
red

Expected Results:  
blue

This is a cool XSS vector, it's ok if it's not fixed! IE has the same bug :).

Comment 1

[Eduardo Vela N]

Attachment: Testcase..

Comment 2

[Eduardo Vela N]

By the way.. any modification to innerHTML/cssText triggers the attack..

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

I don't quite understand this, but perhaps david or daniel do.

Comment 4

[David Baron :dbaron: (⌚️UTC-5, no longer working on Mozilla)]

Looks like there's more than one issue here:
 * not escaping strings properly (duplicate of existing bug, I think)
 * setters taking semicolons and being allowed to set other properties

Comment 5

[Boris Zbarsky [:bzbarsky]]

> * not escaping strings properly (duplicate of existing bug, I think)

Fixed in bug 478160, in fact.

> * setters taking semicolons and being allowed to set other properties

The relevant setter here is the cssText one, which should in fact have this behavior.

The testcase shows "blue" on trunk or 1.9.2.