593602 - Problem with Location object's principal

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

This is trunk-only.

Regression range:
http://hg.mozilla.org/mozilla-central/pushloghtml?startdate=2010-08-20+07&enddate=2010-08-21+04


1. Get a Location object of a window.
2. Load a new document in that window.

The Location object's principal is still the old document's principal.  Thus,
it's possible to get a cross-origin window's location.href.

When a new document is loaded, the Location object's XPCWrappedNative's
XPCWrappedNativeScope does not change, and the XPCWrappedNativeScope's
mScriptObjectPrincipal is the old inner window.  Thus nsXPConnect::GetPrincipal
returns the old inner window's principal with the following assertion failure:

###!!! ASSERTION: Principal mismatch.  Not good: '!aAllowShortCircuit || result
== doGetObjectPrincipal(origObj, PR_FALSE)', file
/home/.../mozilla/caps/src/nsScriptSecurityManager.cpp, line 2470

Comment 1

[moz_bug_r_a4]

Attachment: testcase

Comment 2

[Daniel Veditz [:dveditz]]

There was an 85-changeset tracemonkey merge in that range--including several wrapper fixes from Blake--that's probably the culprit. Need to bisect on the tracemonkey branch to see if we can find the specific bug (so we can track regressions should we ever land whatever it was on stable branches).

Comment 3

[Daniel Veditz [:dveditz]]

CC'ing sirdarckat from bug 576616 so he can see his bug get re-fixed.

Comment 4

[Boris Zbarsky [:bzbarsky]]

This seems like it needs to block....

Comment 5

[Daniel Veditz [:dveditz]]

bug 576616 was externally reported and fixed in the upcoming Firefox 3.6.11 and 3.5.14 releases. We really should release an advisory for the fix, but that leaves Firefox 4 beta users somewhat at risk. This should get fixed in beta8, don't wait for final.

If this seems like a bad plan we can maybe think about a retro-active advisory, but we really hate doing that unless there's the potential for massive pwnage.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

We've already done the "is same origin" check by the time we get into this function. Note that this patch ignores document.domain for location objects. I'll file a separate bug on that.

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/b8fd0155fcd2

Comment 8

[Peter Van der Beken [:peterv]]

http://hg.mozilla.org/mozilla-central/rev/1017ba524465

Comment 9

[Joshua Mitchell (Inactive)]

Issue is resolved - clearing old keywords - qa-wanted clean-up