Closed Bug 856527 Opened 12 years ago Closed 7 years ago

Write test to ensure that about:healthreport doesn't get chrome privileges

Categories

(Firefox Health Report Graveyard :: Client: Desktop, defect, P4)

Product:
Firefox Health Report Graveyard
Component:
Client: Desktop
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED INVALID
Milestone:
Firefox 23

People

(Reporter: mconnor, Unassigned)

Details

(Whiteboard: [measurement:client])

Popped into my head, probably overkill but worth doing at some point.
Component: Metrics and Firefox Health Report → Client: Desktop
Product: Mozilla Services → Firefox Health Report
Target Milestone: mozilla23 → ---
Component: Client: Desktop → about:healthreport
Summary: write test to ensure that about:healthreport doesn't get chrome privs → Write test to ensure that about:healthreport doesn't get chrome privileges
Component: about:healthreport → Client: Desktop
Target Milestone: --- → Firefox 23
Component: Client: Desktop → about:healthreport
This is about the wrapper, not the report.
Component: about:healthreport → Client: Desktop
Ugh, yeah, I guess I missed this. Setting datareporting.healthreport.about.reportUrl to data:text/html,<script>alert(Components.stack);</script> and loading about:healthreport shows that this is indeed a problem. Our use of SSL means that this is hard to exploit, but we need to fix it ASAP.
status-firefox24: --- → affected
status-firefox25: --- → affected
tracking-firefox24: --- → +
tracking-firefox25: --- → +
Summary: Write test to ensure that about:healthreport doesn't get chrome privileges → about:healthreport loads remote content in a chrome-privileged docshell
Wait, I'm maybe wrong about this.
It looks like I am wrong about this: > Services.scriptSecurityManager.isSystemPrincipal(document.getElementById("remote-report").nodePrincipal) true > Services.scriptSecurityManager.isSystemPrincipal(document.getElementById("remote-report").contentWindow.document.nodePrincipal) false Though I'm not sure why...
status-firefox24: affected → ---
status-firefox25: affected → ---
tracking-firefox24: + → ---
tracking-firefox25: + → ---
Summary: about:healthreport loads remote content in a chrome-privileged docshell → Write test to ensure that about:healthreport doesn't get chrome privileges
Whiteboard: p=0
No longer blocks: fxdesktopbacklog
Flags: firefox-backlog+
Whiteboard: p=0 → p=2
Assignee: mconnor → nobody
Whiteboard: p=2 → [measurement:client]
I'm marking this bug as INVALID, because about:healthreport (Firefox Health Report) was removed in bug #1352497.
Status: NEW → RESOLVED
Closed: 7 years ago
QA Contact: Virtual
Resolution: --- → INVALID
Product: Firefox Health Report → Firefox Health Report Graveyard
You need to log in before you can comment on or make changes to this bug.