568564 - (CVE-2010-2754) Suppress the script filename for cross-origin error events (SA39925)

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

See http://secunia.com/advisories/39925

Comment 1

[Boris Zbarsky [:bzbarsky]]

In particular, we need to do that because on redirects we put the post-redirect URI into the JSScript filename field.  If js error reports had an origin not tied to filename, we could take various other approaches here.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Like so

Comment 4

[Michał Gołębiowski-Owczarek [:mgol]]

Proof of concept:
http://0me.me/demo/XSUH/XSUH_demo_firefox_all_in_1.html

Comment 5

[Michał Gołębiowski-Owczarek [:mgol]]

Shouldn't it block 3.6.4?

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Until it gets a sg evaluation it'll be needed but not hard blocking any of the upcoming branch releases; obviously would like a reviewed patch ASAP, but I know people's review queues are busy.

Comment 8

[Jesse Ruderman]

The severity really depends on what information sites reveal through URLs.  

* http://0me.me/demo/XSUH/XSUH_demo_firefox_all_in_1.html got my Google profile ID, and thus a good guess at my email address.  That's a pretty bad privacy violation.

* In theory, a site might reveal a session token. If high-profile sites turned out to do that, we'd call this bug [sg:high].

Comment 9

[Daniel Veditz [:dveditz]]

Self-defense until fixed: block 3rd party cookies and the victim sites can't reveal any personal information.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/mozilla-central/rev/155d4a2be1bc and then http://hg.mozilla.org/mozilla-central/rev/6043ca0d3fba to fix test issues.  Will create a roll-up patch for branches.

Comment 11

[Boris Zbarsky [:bzbarsky]]

Attachment: 1.9.2 fix

Comment 12

[Boris Zbarsky [:bzbarsky]]

Attachment: 1.9.1 merge

Comment 13

[LegNeato]

Comment on attachment 450045 [details] [diff] [review]
1.9.1 merge

a=LegNeato for 1.9.2.6 and 1.9.1.11. Please land this on mozilla-1.9.2 default and mozilla-1.9.1 default.

Comment 14

[Boris Zbarsky [:bzbarsky]]

Pushed:
  http://hg.mozilla.org/releases/mozilla-1.9.1/rev/5fbb842f2ca3
  http://hg.mozilla.org/releases/mozilla-1.9.2/rev/29d60ff7f571

Comment 15

[Samuel]

is this really fixed? why 
http://secunia.com/community/forum/thread/show/4596/firefox_3_6_4_released
why is this happening (to me!)?

i mean, why secunia folks don't think this is fixed? it's their problem? it's mozilla's? is this a situation of ineffective communication?

Comment 16

[Mardeg]

It's fixed on the default 1.9.2 branch as stated, so will be in the next release, Firefox 3.6.7

If you're desperate for a preview build of it, get http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/3.6.7-candidates/build1/win32/en-US/Firefox%20Setup%203.6.7.exe

Comment 17

[Boris Zbarsky [:bzbarsky]]

> is this really fixed?

Yes, but the fix hasn't been shipped yet.  It's fixed in the upcoming 1.9.2.x security release, as comment 16 says.

Comment 18

[Samuel]

@Mardeg OK now I see the "clegnitto: approval1.9.2.7+". Sorry for my blindness. Thx for the info and the tip.

@bz thx!

Comment 19

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Comment on attachment 450045 [details] [diff] [review]
1.9.1 merge

Requesting approval1.9.0.next on this patch so that we can take it in upcoming Camino 2.0.x security and stability updates.  If approved, I'll handle the checkins, unless the patch author requests otherwise.

Comment 20

[Daniel Veditz [:dveditz]]

Comment on attachment 450045 [details] [diff] [review]
1.9.1 merge

Approved for 1.9.0.20, a=dveditz

Comment 21

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Checking in content/base/test/test_bug461735.html;
/cvsroot/mozilla/content/base/test/test_bug461735.html,v  <--  test_bug461735.html
new revision: 1.2; previous revision: 1.1
done
Checking in dom/src/base/nsJSEnvironment.cpp;
/cvsroot/mozilla/dom/src/base/nsJSEnvironment.cpp,v  <--  nsJSEnvironment.cpp
new revision: 1.402; previous revision: 1.401
done