728892 - The attachment "Details" page is still vulnerable to Clickjacking with SVG or XHTML attachments

Status: RESOLVED FIXED

(Bugzilla :: Attachments & Requests, defect)

Description

[Mario Gomes]

User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.21 (KHTML, like Gecko) Chrome/19.0.1041.0 Safari/535.21

Steps to reproduce:

Hello,

The page "attachment.cgi?id=2466&action=edit" still vulnerable to clickjacking in attachment SVG and XHTML.

PoC: https://landfill.bugzilla.org/bugzilla-tip/attachment.cgi?id=2466&action=edit

Cheers,
Mairo.

Comment 1

[Frédéric Buclin]

No need to restrict this bug to the security group as the discussion started publicly in bug 716283, see bug 716283 comment 19 - 24.

Comment 2

[Mario Gomes]

Sorry I forgot that. :}

Comment 3

[Max Kanat-Alexander]

  FWIW, I think that any decision about what a "safe" content type is will just be a slippery slope. As soon as we have to make that decision, we're in an arms race that we'll never win.

  Whitelisting would certainly be safer, but it would then remove some fairly significant functionality that users expect. And as I've mentioned before (and has been proven out) you can't actually predict that *any* content-type will be safe.

  I really don't have a good solution here off the top of my head, except perhaps to start to hook up some sort of heuristic analyzer to incoming Bugzilla attachments that could somehow warn you if they're malicious?

  I think some input from some more-versed security folks would be much appreciated here. Perhaps there are some modern browser features we could take advantage of, or something that would protect us from these sorts of issues?

Comment 4

[Mario Gomes]

A good patch for this can be dont trust in no extension. Show the stuff only in text/plain.

(In reply to Max Kanat-Alexander from comment #3)
>   FWIW, I think that any decision about what a "safe" content type is will
> just be a slippery slope. As soon as we have to make that decision, we're in
> an arms race that we'll never win.

Comment 5

[Mario Gomes]

Attachment: code.js

Comment 6

[Andre Klapper]

What is your last attachment intended to show, and how?
Clicking it I get "Attachment is not viewable in your browser because its MIME type (application/octet-stream) is not one that your browser is able to display. Download the attachment."

Comment 7

[Frédéric Buclin]

Attachment: patch, v1

Using 'sandbox' alone with no values blocks everything. Per the HTML5 spec:

"the embedded page has scripting disabled, plugins disabled, forms disabled, and it cannot navigate any frames or windows other than itself (or any frames or windows it itself embeds)."

Comment 8

[Frédéric Buclin]

If you don't like this commit message, blame mcote and git for not listing files added/modified/deleted. I suppose bmo won't linkify it, despite it has all the info it needs to know which repo and branch I'm talking about.

To ssh://[e-mail]/bugzilla/bugzilla.git
   d51abfd..ca7b39a  master -> master