916983 - Stop allowing write access for named access on cross-origin properties

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Bobby Holley (:bholley)]

A quirk of our implementation currently allows this through. It isn't a security problem because it'll just end up as an expando on the Xray holder, but we should still fix it.

Comment 1

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=0b062fce7c21

Comment 2

[Bobby Holley (:bholley)]

Attachment: Stop allowing writes for named access to cross-origin properties. v1

Bug 916939 does this and more. But since we may have to back that out, I want
to get this into the tree first.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 805671 [details] [diff] [review]
Stop allowing writes for named access to cross-origin properties. v1

Does this still allow cross-origin location.href sets?

Comment 4

[Bobby Holley (:bholley)]

(In reply to Boris Zbarsky [:bz] from comment #3)
> Comment on attachment 805671 [details] [diff] [review]
> Stop allowing writes for named access to cross-origin properties. v1
> 
> Does this still allow cross-origin location.href sets?

Yes. Most of the magic happens in the IsPermitted check. This just causes us to bail for writes before the final IsFrameId check (which goes away entirely in bug 916939).

I would sure hope that comment 1 would be bright orange if cross-origin location.href sets were broken.

Comment 5

[Bobby Holley (:bholley)]

Gabor, how familiar are you with the security wrapper code? Are you comfortable reviewing this patch?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 805671 [details] [diff] [review]
Stop allowing writes for named access to cross-origin properties. v1

r=me

Comment 7

[Gabor Krizsanits (INACTIVE)]

Do you still need a review from me? The patch looks good to me at first glance, does exactly what you want, but if you want me to take some more time looking into it just flag me for review. I would like to think I'm familiar enough with this area.

Comment 8

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?changeset=5ffef86946ed

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7a4b9ce02f96