842255 - (CVE-2013-1671) It's possible to get the full path from a file control

Status: RESOLVED FIXED

(Core :: Layout: Form Controls, defect)

Description

[moz_bug_r_a4]

By using XBL bugs discussed in bug 816071 and bug 817922, it's possible to get the full path from a file control.

Comment 1

[moz_bug_r_a4]

Attachment: testcase

This works on fx10,17-21.

Bug 821850 and bug 834697 are fixed on trunk, but this still works on trunk because currently IsCallerXBL checks the XBL bit regardless of the pref.

Comment 2

[Mounir Lamouri (:mounir)]

Bug 838675 is going to introduce a lot of changes in <input type='file'> and I just tested locally: those changes will just fix this (we no longer show the file path). We are waiting to fix an a11y issue to land them.

Comment 3

[Daniel Veditz [:dveditz]]

assigning to Mounir to take care of after he lands bug 838675

Comment 4

[David Chan [:dchan]]

Changing to sec-bounty- since moz_bug works for us.

Comment 5

[Bobby Holley (:bholley)]

I'm digging through the testcase.

Comment 6

[Alex Keybl [:akeybl]]

We'll track for a specific ESR release once resolved.

Comment 7

[Lukas Blakk [:lsblakk] use ?needinfo]

Given that this is sec-moderate and has now been around for a couple of releases we'll untrack and look at nominations for uplift if a low risk fix is found and verified.

Comment 8

[Johnny Stenback (:jst)]

Mounir, how close are we with fixing the dependencies of bug 838675? If something is stuck there I'm happy to help nudge things along...

Comment 9

[Mats Palmgren (inactive)]

I can't reproduce this in Nightly 22.0a1 (2013-03-23) on Linux64 using a fresh
profile.  When I click "test" in the attached testcase I get:

native anonymous content:

TypeError: Value does not implement interface Node.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Probably because of Bobby's fixes?

Comment 11

[Bobby Holley (:bholley)]

Yeah, XBL scopes + bug 844211 should have fixed this on Nightly and Aurora.

We still need to figure out what we're doing for esr17 and b2g18 though.

Comment 12

[Mats Palmgren (inactive)]

Fixed on trunk (22) and Aurora (21) per comment 11.

Comment 13

[Alex Keybl [:akeybl]]

(In reply to Bobby Holley (:bholley) from comment #11)
> Yeah, XBL scopes + bug 844211 should have fixed this on Nightly and Aurora.
> 
> We still need to figure out what we're doing for esr17 and b2g18 though.

It's sec-moderate, so it's not a required fix on support branches. Sounds like the level of effort, and the risk introduced, may be too high to find ESR/B2G-specific fixes. What do you think Bobby?

Comment 14

[Bobby Holley (:bholley)]

(In reply to Alex Keybl [:akeybl] from comment #13)
> (In reply to Bobby Holley (:bholley) from comment #11)
> > Yeah, XBL scopes + bug 844211 should have fixed this on Nightly and Aurora.
> > 
> > We still need to figure out what we're doing for esr17 and b2g18 though.
> 
> It's sec-moderate, so it's not a required fix on support branches. Sounds
> like the level of effort, and the risk introduced, may be too high to find
> ESR/B2G-specific fixes. What do you think Bobby?

Well, XBL scopes fix a number of known sg-crits, but are probably too big to backport. Our best hope is probably to just embargo all these bugs until esr17 / b2g18 EOL.