959531 - (CVE-2014-1489) settings & history ID bug

Status: VERIFIED FIXED

(Firefox :: General, defect)

Description

[Yazan Tommalieh]

Attachment: bug.png

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 (Beta/Release)
Build ID: 20131205075310

Steps to reproduce:

Create an html page with the following markup:

<button name="settings" id="settings">settings</button>
<button name="history" id="history">history</button>


Actual results:

when i click on the settings button, it opens the settings of the firefox, 
same results for the histroy button, it opens the firefox histroy window.


Expected results:

It should invoke my code whether its JavaScript or any other action.

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: testcase 959531.html

I can't reproduce with Firefox 26 or 29 (Nightly) on Linux.

Comment 2

[Bob Clary [:bc] (inactive)]

But I could on Windows 7 with Firefox 26 and 29 but not Firefox 25.

Comment 3

[Yazan Tommalieh]

yes it's on windows 7 and not every time, sometimes it happens and sometimes it doesn't.

Comment 4

[Yazan Tommalieh]

i figured it out, the innerHTML of the button is case sensitive ("Settings", "History"), it happens in this case only, in addition to the element ID

<button type="button" class="abutton" id="settings">Settings</button>
<button id="history" class="abutton" type="button">History</button>

Comment 5

[Benjamin Smedberg]

Reproducing this requires that the tab in question have loaded about:home first.

This is a regression from bug 899222, where about:home adds event listeners to operate the settings/bookmarks buttons. It appears that these listeners are being set on the window and not the document, so they are not unset on page navigation.

This is unlikely to be an actual security issue, but since I'm not certain I'll leave it for billm to decide whether to leave this bug private.

Comment 6

[Yazan Tommalieh]

ok thanks alot .

Comment 7

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

I think that "Restore Previous Session" is the worst that could happen here. Your current session would be lost, which is pretty bad.

Comment 8

[Yazan Tommalieh]

oh ok, thanks Bill !

Comment 9

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: about-home-fix

Ugh, a frustrating bug. I used |this| inside an event handler. In the fix, I wanted to use an arrow function, but the function also needs to refer to itself, which arrow functions can't do.

Comment 10

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Attachment: about-home-test

Fails without the patch, passes with it.

Comment 11

[:Felipe Gomes (needinfo for replies!)]

The patch fixes it, but should we make it more robust by double checking onClick that our doc is about:home?

Comment 12

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

OK, I can do that.

Comment 13

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/76cf1178c524

Comment 14

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Somehow this didn't get resolved.
https://hg.mozilla.org/mozilla-central/rev/76cf1178c524

Comment 15

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Comment on attachment 8360727 [details] [diff] [review]
about-home-fix

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 899222
User impact if declined: A malicious site could make a button that causes the user's session to be lost (and the previous one restored).
Testing completed (on m-c, etc.): On m-c.
Risk to taking this patch (and alternatives if risky): Pretty low. It's a very straightforward change.
String or IDL/UUID changes made by this patch: None

Comment 16

[Bill McCloskey [inactive unless it's an emergency] (:billm)]

Do you mind taking care of this Ryan? Thanks.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/e05b56b61342
https://hg.mozilla.org/releases/mozilla-beta/rev/1b3060857876

Comment 18

[Matt Wobensmith [:mwobensmith][:matt:]]

For whatever reason, I wasn't able to reproduce on a Win7 system with Fx26, even when about:home was open previously. However, I am able to see it consistently on the Mac.

Verified Fx28 release build.
Verified Fx29, build from 2014-02-10.

Comment 19

[Mihaela Velimiroviciu (:mihaelav)]

Setting in-testsuite+ as this bug has a browser chrome test.