812546 - It's possible to spoof document.referrer due to GetCxSubjectPrincipalAndFrame

Status: RESOLVED DUPLICATE of bug 810808

(Core :: Security, defect)

Description

[moz_bug_r_a4]

When there is no frame, GetCxSubjectPrincipalAndFrame can return the wrong principal, thus it's possible to spoof document.referrer.

This is a regression from bug 754202. (fx16,17,18 are affected.)

Note: bug 797204 fixed this bug on trunk, but, currently the testcase for this bug also works on trunk due to bug 810808.

Comment 1

[moz_bug_r_a4]

Attachment: show document.referrer

This is used to show document.referrer.

Comment 2

[moz_bug_r_a4]

Attachment: testcase

This works on fx16,17,18 (and trunk due to bug 810808).

Comment 3

[Johnny Stenback (:jst)]

bholley, how close to bug 810808 is this one? Close enough to dupe? Or different enough to keep separate?

Comment 4

[Bobby Holley (:bholley)]

(In reply to Johnny Stenback (:jst, [e-mail]) from comment #3)
> bholley, how close to bug 810808 is this one? Close enough to dupe? Or
> different enough to keep separate?

The exploits affect different branches, but the eventual fix will be the same.

Comment 5

[Bobby Holley (:bholley)]

I think we can now dupe this to bug 810808.