965082 - XrayWrapper::{get,set}PrototypeOf is callable for SecurityWrappers

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Bobby Holley (:bholley)]

This is a regression from bug 926012. When we override the ::getPrototypeOf and ::setPrototypeOf traps for XrayWrappers, we end up doing so for SecurityWrapper as well, which is not great.

This allows callers to instantiate an expando object on cross-origin objects, and munge the proto. This isn't a security problem per-se, but it's dicey. Marking s-s just to be safe.

Also, bug 926012 is only on Nightly, so we have some time.

Comment 1

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=0a83ab906312

Comment 2

[Bobby Holley (:bholley)]

Attachment: Part 1 - Unify duplicate bits of state of proxies. v1

Conceptually, these all boil down to "is this a security wrapper?"

Comment 3

[Bobby Holley (:bholley)]

Attachment: Part 2 - Only run the {get,set}PrototypeOf override for non-SecurityWrappers. v1

Comment 4

[Bobby Holley (:bholley)]

Attachment: Part 3 - Tests. v1

Comment 5

[Gabor Krizsanits (INACTIVE)]

Comment on attachment 8367432 [details] [diff] [review]
Part 3 - Tests. v1

Review of attachment 8367432 [details] [diff] [review]:
-----------------------------------------------------------------

+
+
+  </script>
+</head>

Extra new line

Comment 6

[Bobby Holley (:bholley)]

remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/f8768358ad0f
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/2d36a17e88c5
remote:   https://hg.mozilla.org/integration/mozilla-inbound/rev/b1974150d1a5

Comment 7

[Carsten Book [:Tomcat]]

landed on central
https://hg.mozilla.org/mozilla-central/rev/f8768358ad0f
https://hg.mozilla.org/mozilla-central/rev/2d36a17e88c5
https://hg.mozilla.org/mozilla-central/rev/b1974150d1a5