774355 - HTML/CSS code injection vunerability / rendering failure

Status: RESOLVED INCOMPLETE

(Firefox :: Untriaged, defect)

Description

[Darren Lue Choy]

Attachment: Test case and comparison of output from FF13 and IE6

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20100101 Firefox/13.0.1
Build ID: 20120614114901

Steps to reproduce:

Test Case:
http://www.hastebin.com/rugasibuni.xml

While trying to provide technical support on a forum found that content was not being rendered. Assumed wrongly (for a change) that this was because of IPB when infact it is FireFox (13.0.1).

This only appears to happen with 'terminal' is selected as a font.


Actual results:

Content of inner tag is interpreted as part of a larger regex expression; experimentation at random premutations (on the false assumption that it was the forum software) caused the inner tag to start being interpreted as javascript in all prior-known premutations. Restarting created a third regex behaviour.


Expected results:

'terminal' not being a web-font name should have been ignored and the monospace font substituted instead.

Arbitary code should not have been executed, and the results of that execution should not have persisted.

FireFox 13 should not be upstaged by goddamn IE6.

Comment 1

[Darren Lue Choy]

Forgot to state that the previous result of the test case provided for unbroken groups was "Font F+IyYML" and "Font F+IYML" for broken ones.

Except when being interpreted as javascript copying blocks of misrendered text returns the correct characters.

Comment 3

[Daniel Veditz [:dveditz]]

please don't mess with keywords or other bug markings you're not sure about. "sec-audit" is used for stale code that has no known problems (but might) and flags a bug as a lower-priority task. Worse, it takes it out of the queue of incoming bugs that the security team is actively looking at -- we're only seeing this now, two weeks later.

Comment 4

[Daniel Veditz [:dveditz]]

This does not look like an exploitable security vulnerability. Unhiding bug so the regular developers can investigate.

Comment 5

[(mostly gone) XtC4UaLL [:xtc4uall]]

If this is still an Issue please provide a (new) reduced Testcase.
I see no rendering differences amongst Firefox, Chrome ans MSIE 11.

Comment 6

[Phoenix]

Resolved per whiteboard