613935 - Location bar spoofing: Form History dropdown can appear entirely outside of the content area

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jordi Chancel]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.1; fr; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12

When an user copy/paste or write data into <input type=text> , data is saved in form history .
if an <input type="text"> was into a <DIV style=top:-105px;> this input is out the webpage but form history was totaly visible. (view ScreenShot)

Reproducible: Always

Steps to Reproduce:
1=> Create an html file with a special javascript
2=>interact with this webpage
Actual Results:  
location bar is spoofed


Vulnerability found by Jordi Chancel

Comment 1

[Jordi Chancel]

Attachment: Screenshot

Comment 2

[Reed Loden [:reed]]

Do you have a testcase you could attach?

Comment 3

[Jordi Chancel]

Attachment: Testcase1 (A)

Comment 4

[Jordi Chancel]

Attachment: Testcase1 (B)

Comment 5

[Jordi Chancel]

Attachment: Testcase1 (B)

Comment 6

[Daniel Veditz [:dveditz]]

> [e-mail] 	2010-11-22 04:42:20 PST
> Whiteboard ->	sg:low or moderate ? 

Pro-tip -- if you add your own "sg" marking to the whiteboard of a security bug that removes it from the list of "new security bugs to investigate" that the security team uses. The bug can end up lost that way. Suggesting ratings in the comments would be a better approach. Thanks!

Comment 7

[Jordi Chancel]

Attachment: ScreenShot2

Comment 8

[Jesse Ruderman]

Clever!

Comment 9

[Jesse Ruderman]

CCing our friends from bug 575294.

Comment 10

[Johnny Stenback (:jst)]

Olli, I think this is one of the bugs that you and I discussed that is similar to another bug you're working on.

Comment 11

[Jordi Chancel]

Attachment: TestCase3

Comment 12

[Dave Townsend [:mossop]]

Testcase doesn't seem to work for me on trunk, is this only a problem on the branch?

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

It happens on trunk too.

Comment 14

[Jordi Chancel]

now this spoofing works on google chrome.

Comment 15

[Dave Townsend [:mossop]]

Not a regression or critical so not going to block the release on this.

Comment 16

[Jordi Chancel]

Why the URL was considered UNSAFE?

It's just a Mario Bross Game with the location bar spoofing ...

Comment 17

[Jordi Chancel]

why this vulnerability is moderate? I think it's a very low .

Comment 18

[Jordi Chancel]

Like Bug 575294 , I think there is possible to make persist the Form history.
sg:moderate is finally appropriate.

Comment 19

[Justin Dolske [:Dolske]]

What's the key here? Just that the autocomplete dropdown attempts to follow the form field when scrolling (such that if it's off the page, it's mistakenly not clamped to the tab boundaries?)

Comment 20

[Jesse Ruderman]

Yes. Bug 575294 (especially the dup bug 308278) is more about not constraining the position and size when the <select> is first opened, I guess.

Comment 21

[Jordi Chancel]

I have found a possible way to make persistant the history content of the input text. can y send a new bug ?

Comment 22

[Matt Wobensmith [:mwobensmith][:matt:]]

We agree that this is more accurately rated as a sec-low.

Comment 23

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

The current testcase doesn't reproduce for me, so this may have been fixed. In any case, this is not the correct component. I'm guessing DOM might be?

Comment 24

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

This does seem to be fixed