796647 - [System] Vulnerability analysis issues

Status: RESOLVED WORKSFORME

(Firefox OS Graveyard :: Gaia::System, defect)

Description

[GH to BZ]

[GitHub issue by mcjimenez on 2012-09-14T09:48:55Z, https://github.com/mozilla-b2g/gaia/issues/4731]
We have run an automated vulnerability analysis on the Gaia code. 
After manually filtering the results we have found the following possible issues on the system app:

* /js/cost_control.js 

On line 21 of cost_control.js the program posts a cross-document message with an
overly permissive target origin.

```html
19
20 function _redirectToWidget(evt) {
21 widgetFrame.contentWindow.postMessage({
22 type: evt.type
23 }, '*');
```
The message it's being posted to a frame/window that's different from the current window. So the
possible destination should be restricted, so the message is only posted if the destination window has the correct content (in this case costcontrol.origin)


* /js/voicemail.js

On line 11 of voicemail.js the program uses insecure Randomness. Standard pseudo-random number generators cannot withstand cryptographic attacks.

```html
9 notification: null,
10 // A random starting point that is unlikely to be used by other notifications
11 notificationId: 3000 + Math.floor(Math.random() * 999),
12
13 init: function vm_init() {
```
Javascript random() function cannot be initialized with a pseudorandom seed. That means that several calls executed at around the same time will return the same value (and the same sucessive value chain). That way, notificationID values could be repeated.

Comment 1

[GH to BZ]

[GitHub comment by mcjimenez on 2012-09-15T09:54:01Z]
cc @AntonioMA

Comment 2

[Kevin Grandon :kgrandon]

None of these lines match up anymore, so I'm assuming this was fixed at some point. Please open a new bug if there are still issues with these files.