619359 - Security problem with History object

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

1. Get a History object from a same-origin window.
2. Load a target page in that window.

On trunk, it's possible to call history.pushState/replaceState on the target
page.

On 1.9.2/1.9.1 branches, History object does not have abusable methods.

Comment 1

[moz_bug_r_a4]

Attachment: testcase - XSS

This tries to get cookies for html5demos.com.
This works on trunk.

http://html5demos.com/history/ basically does:
elem.innerHTML = event.state.x;

Comment 2

[Justin Lebar (not reading bugmail)]

Looking at this.

Comment 3

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Is bug 608872 intended to fix this?

Comment 4

[Justin Lebar (not reading bugmail)]

(In reply to comment #3)
> Is bug 608872 intended to fix this?

Yes, says mrbkap.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

I'm about to send this through try.

Comment 6

[Johnny Stenback (:jst)]

This passed on try, so I landed it on m-c. And I forgot to update the bug number in the coment, where 691359 should be 619359, even though I pointed out that mistake to mrbkap myself last night :(

http://hg.mozilla.org/mozilla-central/rev/a79b46eef8f2