580804 - cert exception procedure can be accelerated with clickjacking

Status: RESOLVED DUPLICATE of bug 633691

(Core Graveyard :: Security: UI, defect)

Description

[Sid Stamm [:geekboy or :sstamm]]

Elie Bursztein reported to me:

A site can overlay a frame with a bad cert and steal two clicks to simulate opening the "I understand the risks" call-out, and "Add Exception" buttons.  This secretly bypasses the hidden cert error page requiring the user to only click "Confirm Security Exception" in the final dialog to add the cert exception.

Comment 1

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Could we make the "Add exception" button be a "open in top window" button if the page is iframed? Which would set top.location = window.location when clicked.

Comment 2

[Sid Stamm [:geekboy or :sstamm]]

+1 for "open in top window"

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

We have to watch out for the parent page reaching into the child iframe and messing up whatever "are we iframed" checks we do.

Comment 4

[Sid Stamm [:geekboy or :sstamm]]

Would it make sense to have a separate page entirely for framed errors?  Yeah, I know, it's lots of duplication, but then the code linking to the cert exception dialog couldn't possibly be called from the outer page if it doesn't exist.

Maybe that's overkill.  Maybe there's enough cross-domain action going on that it wouldn't be scriptable.