Open Bug 682565 Opened 13 years ago Updated 2 years ago

Infinite save dialog loop block with document.location reassignment

Categories

(Firefox :: Security, defect)

Product:
Firefox
Component:
Security
Version:
6 Branch
Platform:
x86
Windows XP
Type:
defect

Tracking

()

Status:
UNCONFIRMED

People

(Reporter: zpzp0909, Unassigned)

References

(Blocks 1 open bug)

Details

Attachments

(2 files)

text in address bar or ready html file
3.82 KB, text/html
Details
screenshot
215.19 KB, image/jpeg
Details
User Agent: Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.9.168 Version/11.50 Steps to reproduce: write in address bar text: data:text/html;, <embed src="data:text/html;,<script>alert(0);</script>" type="text/html"> <iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:video/avi;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:video/avi;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:video/mpeg;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:video/mpeg;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:image/png;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:image/png;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:image/gif;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:image/gif;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> <iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> .......... <script>setTimeout(function(){document.location=document.location;},1);</script> Actual results: visual interface bug, many iframes, many save dialogs, many alerts Expected results: correct display of, without rapid changes
Attached image screenshot —
Comment on attachment 556262 [details] text in address bar or ready html file >data:text/html;, ><embed src="data:text/html;,<script>alert(0);</script>" type="text/html"> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:video/avi;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:video/avi;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:video/mpeg;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:video/mpeg;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:image/png;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:image/png;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:image/gif;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:image/gif;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><iframe src="data:text/html;,<script>alert(0);</script>" type="text/html"></iframe> ><script>setTimeout(function(){document.location=document.location;},1);</script>
Attachment #556262 - Attachment mime type: text/plain → text/html
What would you expect Firefox to do in this case? All browsers I tested seem to react the same as Firefox...
(In reply to Tim (fmdeveloper) from comment #3) > What would you expect Firefox to do in this case? All browsers I tested seem > to react the same as Firefox... allow the script to stop.
Blocks: eviltraps
Component: General → Security
See Also: → 682569
Summary: firefox visual interface bug, many iframes, many save dialogs, many alerts → Infinite save dialog loop block with document.location reassignment
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: