628231 - Arbitrary code execution using history.pushState

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

When calling history.pushState, nsDocShell::StringifyJSValVariant pushes a JS
context associated with the history object.  Thus, it's possible to call a
native function without a frame or a pushed principal, in which case a result
of nsScriptSecurityManager::IsCapabilityEnabled() is true.

1.9.2/1.9.1 branches do not have history.pushState method.

Comment 1

[moz_bug_r_a4]

Attachment: testcase

This uses bug 344495's trick.

Comment 2

[Jeff Walden [:Waldo]]

I've heard discussion of issues like this over desk separators in the office, so conceivably this is known and/or a dup -- adding people in or implicated in those discussions to the CC list.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

There are better fixes. But they'll have to wait until after Firefox 4 has shipped (namely attaching the context principals stack to the compartment).

Comment 4

[Johnny Stenback (:jst)]

Fix landed:

http://hg.mozilla.org/mozilla-central/rev/244738bdb248

Comment 5

[Johnny Stenback (:jst)]

This got backed out due to crashes on tbpl. mrbkap has a fix, but we deemed it too dangerous to land this late tonight.

http://hg.mozilla.org/mozilla-central/rev/3eaae2138586

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Updated fix

The last patch had a dumb mistake in it and would try to do stuff even if we hadn't set obj. This one avoids that mistake.

Comment 7

[Johnny Stenback (:jst)]

Comment on attachment 508037 [details] [diff] [review]
Updated fix

r=jst, but there's some 2 vs 4 space indentation inconsistencies here. I can fix that when I land this...

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fixing that too

Comment 9

[Johnny Stenback (:jst)]

Updated fix landed.

http://hg.mozilla.org/mozilla-central/rev/5502c6978c73

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Verified bad behavior in Firefox 4 b10 and fix in b11 build (Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b11) Gecko/20100101 Firefox/4.0b11) using attached testcase.