928187 - (CVE-2016-5283) <iframe src> fragment timing attack can reveal private data

Status: RESOLVED FIXED

(Core :: Layout, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

See bug 881087.

Comment 1

[Andrew McCreight [:mccr8]]

Mats has a patch in progress in bug 881832, so I'm going to assign this to him.  Also, it sounds like this is therefore a layout bug and not DOM?

Comment 2

[bhavana bajaj [:bajaj]]

Hey :mats, any updates here on next steps given we are a couple of beta's away from shipping firefox 27 ?

Comment 3

[Mats Palmgren (inactive)]

I still need to figure out the last test failure in bug 881832, which has proven rather
elusive so far.  Besides, the patch in bug 881832 has a high risk for regressions so
I wouldn't recommend it for beta.

Comment 4

[Lukas Blakk [:lsblakk] use ?needinfo]

(In reply to Mats Palmgren (:mats) from comment #3)

We're a couple of betas into FF28 now - if comment 3 is still the case, we can no longer track for 28 anymore.  Please update with current status.

Comment 5

[Mats Palmgren (inactive)]

No change since comment 3.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Clearly tracking this isn't useful.

Comment 7

[Andrew McCreight [:mccr8]]

Jet, is there somebody who can get bug 881832 over the finish line?  This sec-high bug is almost a year old now.

Comment 8

[Jet Villegas (inactive)]

Working on it...

Comment 9

[Andrew McCreight [:mccr8]]

Johnny, can you please find somebody to work on this? The actual work is happening in bug 881832, which has had a reviewed patch since June 2013, but it causes test_hover.html to fail. Every few months somebody unbitrots the patch and confirms that the test still fails but nobody has actually fixed it yet, and that has been going on for two years now. Thanks.

Comment 10

[Liz Henry (:lizzard) (relman/hg->git project)]

In bug 881832 there is some pretty recent work and we seem close to a fix.  

Since this is sec-high, I'd like to track it for 47 in hopes we can make progress.

Comment 11

[Liz Henry (:lizzard) (relman/hg->git project)]

mats, any luck here? I would love to get this fixed in 47.

Comment 12

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Sec-high issue that is tracked for 47, changing the flag to blocking so it gets some attention.

Comment 13

[Mats Palmgren (inactive)]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #11)
> mats, any luck here? I would love to get this fixed in 47.

Not really, I've tried a few times to sort out the issues in bug 881832,
but it doesn't seem to work, so I have given up on that one, sorry.

Comment 14

[Andrew McCreight [:mccr8]]

Matt has some patches up for review in the public bug, so I'll assign this to him. Hooray!

Comment 15

[Ritu Kothari (:ritu) (Inactive, please n-i to RyanVM, jcristau, or pascal)]

Removing the blocking flag as we have had this issue for a few releases now.

Comment 16

[Matt Woodrow (:mattwoodrow)]

I don't actually have access to the bug in comment 0, but I believe my patches in bug 881832 are sufficient to fix this.

Comment 17

[Daniel Veditz [:dveditz]]

[Tracking Requested - why for this release]:
We should have landed this one on ESR-45 to go with the 49.0 release. Too late?

Comment 18

[Liz Henry (:lizzard) (relman/hg->git project)]

We had several chances to get this in 49. The patches in bug 881832 are kind of large and look to be related to bugs in Google Docs, sheets, etc. I haven't sorted out whether those bugs were regressions caused by it and now fixed, or whether they were made dependencies later to make it clear what fixed them. But I'm reluctant to uplift this to ESR until we see what kind of regressions pop up once it hits the release channel. This looks to me like the sort of change where we may not get the same broad user coverage on beta as we will on release.

Comment 19

[Liz Henry (:lizzard) (relman/hg->git project)]

Please feel free to argue otherwise - I'll leave this as tracking-esr45:? for the moment.

Comment 20

[Liz Henry (:lizzard) (relman/hg->git project)]

When this lands on ESR we should also uplift the fix for bug 1293985 and likely other from the depends-on bugs mentioned here. Matt, does that make sense to you?

Comment 21

[Matt Woodrow (:mattwoodrow)]

(In reply to Liz Henry (:lizzard) (needinfo? me) from comment #20)
> When this lands on ESR we should also uplift the fix for bug 1293985 and
> likely other from the depends-on bugs mentioned here. Matt, does that make
> sense to you?

Yes, definitely.

Comment 22

[Liz Henry (:lizzard) (relman/hg->git project)]

Andrei, making sure you have access to this bug for testing ESR.

Comment 23

[Liz Henry (:lizzard) (relman/hg->git project)]

Looks like this landed 6 days ago on esr45, in bug 881832.