554832 - test_info_leak fails on Win7 with Skype running

Status: RESOLVED WORKSFORME

(Core :: Audio/Video, defect)

Description

[Chris Pearce [:cpearce (Not reading bugmail)]]

Mochitest content/media/test/test_info_leak.html fails on trunk on fully-patched Windows7 Pro 64bit when Skype 4.1.0.179 is running. This may also occur with other versions of Skype and Windows; Matthew Gregan tells me he saw this test fail on his Win7 beta machine, on which he runs Skype. This test fails on trunk nightly builds at least back as far as 1 January 2010.

test_info_leak creates <video> elements and with invalid src URLs, and checks that we don't "leak" any state or events which can be used by script to determine whether the URL can be resolved from the client domain (as opposed to being accessible from the webserver's domain). I think this should be a security bug because this *may* (I'm not sure if it *will*) leak state if a client-only-resolvable URL is set as a <video>'s src attribute when Skype is installed.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Chris, what's the skype addon version you have?  IS the problem still present with the addon disabled?

Comment 2

[Chris Pearce [:cpearce (Not reading bugmail)]]

I don't have a Skype Addon installed, Skype was somehow interfering with the Firefox process. I'm now running Skype 4.2.0.115, and test_info_leak doesn't fail running current trunk. Maybe Skype fixed it on their end. Resolving WFM...

Comment 3

[cajbir (:cajbir)]

I'm running Skype 5.0.0.152 and test_info_leak still fails for me on Windows 7.

Comment 4

[Boris Zbarsky [:bzbarsky]]

So this is just skype without the skype extension?

Comment 5

[cajbir (:cajbir)]

yes

Comment 6

[Maire Reavy [:mreavy]]

Chris D -- Since you were the last one to repro this bug, could you retest now and see if it is still happening?  Thanks.

Comment 7

[cajbir (:cajbir)]

I no longer run Windows so cannot test, sorry.

Comment 8

[Maire Reavy [:mreavy]]

Chris P -- Since Chris D can no longer test this readily, do you think you could try to repro with the recent versions of Skype and Firefox?  

I wouldn't be surprised if this bug were fixed now (either by our code changing or Skype's).  I believe this is the last, older, media security bug that is still open.

Comment 9

[Chris Pearce [:cpearce (Not reading bugmail)]]

I retested on Winows 7 x64 Pro with Skype 6.3.0.105 and mozilla-central from Wed Mar 20, 2013, and the failure no longer occurs.

-> WFM.