535688 - Only hand inner windows to C++ from JS

Status: RESOLVED DUPLICATE of bug 536480

(Core :: XPConnect, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

(Filing as security sensitive because bug 531364 hasn't been fixed yet)

Currently, wrappers do a security check when they are unwrapped, which prevents malicious things like addEventListener.call(cross_origin_iframe, ...). However, as moz_bug_r_a4 found out, what this really means is that they do the security check and, in the case of windows, hand out an *outer* object. This means that if JS code can force the window to change origins, then the security check becomes outdated.

We should investigate only ever handing *inner* windows out to C++ when coming in from JS, so that the security check continues to mean the same thing no matter what other program state changes.

peterv came up with a partial patch in bug 531364, but got deterred because we have to make sure that direct callers of the nsIXPConnect unwrapping APIs correctly deal with getting inner windows instead of outer windows from JS.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

Er, oops.