605167 - It's possible to access properties of a cross-origin window

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

This is a regression from landing of compartments.

1. Get a function from a same-origin window.
2. Load a cross-origin page in that window.

With that function, ComputeGlobalThis gets an outer window proxy that belongs
to the cross-origin window.  Thus, it's possible to access properties of the
cross-origin window via that outer window proxy.

The attached testcase aborts a debug build:
Assertion failure: compartment mismatched, at
/home/.../mozilla/js/src/jscntxtinlines.h:513

Comment 1

[moz_bug_r_a4]

Attachment: testcase

This tries to get cookies for www.mozilla.com.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Andreas has a patch in bug 604516 that gets rid of the inner and outer object hooks in favor of slots with the outer object for that compartment. That'll make this patch obsolete, but the upshot here is that we need to make sure that when we outerize, we return the outer window for the right compartment.

I looked through all of the cases where we outerize and it appeared that there were exactly two where we actually wanted the uncompartmentalized outer window (both in WrapperFactory.cpp).

Comment 3

[Luke Wagner [:luke]]

Comment on attachment 484098 [details] [diff] [review]
Fix

Sorry, I enjoyed the discussion, but I am unqualified to review this.

Comment 4

[Peter Van der Beken [:peterv]]

Comment on attachment 484098 [details] [diff] [review]
Fix

Please add an automated testcase.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/tracemonkey/rev/cc731e6910ad

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/179e4661d61c
http://hg.mozilla.org/mozilla-central/rev/8851d28f1619