Bugzilla@Mozilla – Bug 503226
document.getSelection() can read cross-origin content selections
Last modified: 2009-10-27 19:39:49 PDT
Summon comment box
User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.0.11) Gecko/2009060214 Firefox/3.0.11 Build Identifier: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.1pre) Gecko/20090708 Shiretoko/3.5.1pre The document.getSelection() method can be used to read cross-origin content selections. By storing a reference to the contentDocument of an iframe, any selections made within that iframe can be read regardless of origin. This method appears to be deprecated. Reproducible: Always
Created attachment 387576 [details] example of reading cross-origin selections Select destination for iframe and select 'go'. Make a text selection and the content should be displayed in an alert box.
The test shows the reported behaviour. I suspect this should live in Content-land, particularly since jst wrote the deprecation message. :)
Marking this a blocker since this allows cross site data leakage.
Created attachment 394093 [details] [review] simple patch
Comment on attachment 394093 [details] [review] simple patch AFAIK, security bugs need separate r and sr nowadays.
Comment on attachment 394093 [details] [review] simple patch mochitest?
Don't want to add such before this is fixed everywhere.
http://hg.mozilla.org/mozilla-central/rev/0aa2596a20cc
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/015c3c8cf077
Comment on attachment 394093 [details] [review] simple patch Approved for 1.9.1.4 and 1.9.0.15, a=dveditz for release-drivers
Checking in content/html/document/src/nsHTMLDocument.cpp; /cvsroot/mozilla/content/html/document/src/nsHTMLDocument.cpp,v <-- nsHTMLDocument.cpp new revision: 3.792; previous revision: 3.791 http://hg.mozilla.org/releases/mozilla-1.9.1/rev/bffd0a33d902
Verified attached testcase reproduces bug in 1.9.1.3 and is fixed in the 1.9.1.4pre build (Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.4pre) Gecko/20090914 Shiretoko/3.5.4pre).
Verified for 1.9.0.15 as well with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.15pre) Gecko/2009091606 GranParadiso/3.0.15pre (.NET CLR 3.5.30729).
(In reply to comment #9) > Don't want to add such before this is fixed everywhere. I can has test plz?