Closed Bug 608872 Opened 14 years ago Closed 11 years ago

Brain transplant history objects

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME
Tracking Flags:
Tracking Status
blocking2.0 --- -

People

(Reporter: mrbkap, Assigned: mrbkap)

References

Details

(Keywords: sec-want, Whiteboard: [sg:want] preventative[compartments]) 

History objects are like the outer window in terms of security. We need to brain transplant them to be safe. This relies on brain transplanting wrapped natives, though.
This should block b8.
blocking2.0: --- → ?
blocking2.0: ? → beta8+
blocking2.0: beta8+ → ?
blocking2.0: ? → beta8+
Whiteboard: [sg:want] preventative
Whiteboard: [sg:want] preventative → [sg:want] preventative[compartments]
Assignee: nobody → mrbkap
Per discussion with mrbkap and gal we don't need to finalize this for beta8, pushing to beta9.
blocking2.0: beta8+ → beta9+
As per today's meeting, beta 9 will be a time-based release. Marking these all betaN+. Please move it back to beta9+ if  you believe it MUST be in the next beta (ie: trunk is in an unshippable state without this)
blocking2.0: beta9+ → betaN+
Whiteboard: [sg:want] preventative[compartments] → [sg:want] preventative[compartments], hardblocker
Whiteboard: [sg:want] preventative[compartments], hardblocker → [sg:want] preventative[compartments][hardblocker]
Given that we're fixing bug 619359, and the way we're fixing it, we don't need this fixed for 2.0. We still want to do this, but no immediate rush. Moving to blocking .x.
blocking2.0: betaN+ → .x
Whiteboard: [sg:want] preventative[compartments][hardblocker] → [sg:want] preventative[compartments]
blocking2.0: .x+ → -
We don't need to do this -- on old branches, we already have the proper security checks and we deny access entirely to the history object on trunk.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → WORKSFORME
On trunk, we deny *cross origin* access to the history object.
Group: core-security → core-security-release
Group: core-security-release
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.