821591 - Contacts API access roles (create vs update) is enforced in the child not the parent.

Status: RESOLVED INVALID

(Firefox OS Graveyard :: General, defect)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

The contacts:save message is used for both saving a contact and create a new contact. The logic for deciding whether the contact is new or an update is in the child[1] which means that a compromised child process with the "create" access role can actually modify existing contacts, as if they had "update". ( I.E. the child could just change the reason for the save to create, but use an existing ID). There should be a check in the parent[2] that if its a create, then make sure the contact doesn't already exist.

[1] http://mxr.mozilla.org/mozilla-central/source/dom/contacts/ContactManager.js#517
[2] http://mxr.mozilla.org/mozilla-central/source/dom/contacts/fallback/ContactService.jsm#158

Comment 1

[Alex Keybl [:akeybl]]

Is this necessary for v1? If so, please nominate for b-b?

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

I think the risk here is pretty minor - its basically an escalation from contacts read permission to contacts write permission, but only once you have already compromised the child process, by which point you can do way worse things at the moment. So I think this is non-blocking for basecamp.

Comment 3

[Andrew Overholt [:overholt]]

koi? since it blocks bug 820202 but we don't usually block on meta bugs (which bug 820202 is).

Comment 4

[bhavana bajaj [:bajaj]]

needinfo Paul here to see if this is really a 1.2 blocking  given we are already feature complete on that branch, in which case this is koi- .

Comment 5

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Koi- is fine. All he bugs blocking 820202 should be considered a priority for security hardening but all require an additional vulnerability to exploit. (That is, unless I have explicitly called them out as blocking.)

Comment 6

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Contacts API is gone.