User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322) Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3 The url "about:" can be accessed by a website, but it takes some cross site scripting (using another vuln submitted by me) to javascript:document.write (""); onto the about: page to show its true url (chrome://global/content/about.xhtml). From there, the page is treated under chrome priviledges and system access is easy. Reproducible: Always Steps to Reproduce: 1. http://greyhatsecurity.org/secretfoldervulns/about.htm 2. Click the link 3. Wait about 2 seconds Actual Results: Script executed in chrome Expected Results: about: page navigation from internet pages should be disallowed

Testcase doesn't work in my current build, but linking to about: seems to be a bad thing in general.

I can't think of anything this would break... We should think about the "about:foo points to chrome" concept as a potential attack vector in general. Shaver's suggestion was to deprivillege about: completely, moving about:config and friends requiring chrome access to system:*, and possibly blocking any linking to these URLs. What's left in about: should not have chrome URLs or any privs at all. But for the branch, we can just flip this off, the others seem to be safe, for now (and in about 5 minutes, someone will prove me wrong I'm sure).

Brendan: Can you review the patches and give the a= so we can get this checked in soon? Thanks.

Comment on attachment 186337 [details] [diff] [review] block about: from chrome Yeah, let's go. This is overdue. /be

Comment on attachment 186337 [details] [diff] [review] block about: from chrome We want this on the branch too. a=jay

i seem to recall having a patch which we backed out that let documents retain their proper url instead of having them morph :(

Updated product/component per timeless. Since this is core, we should probably get this in 1.7.9 also, right? Nominating...

checked in to aviary/1.7/trunk

v.fixed on aviary with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.9) Gecko/20050706 Firefox/1.0.5 using original testcase. about: cannot be loaded.

Adding distributors

FF1.0.5 advisories published