Closed
Bug 636147
Opened 14 years ago
Closed 14 years ago
Chrome privileges in the content scripts
Categories
(Add-on SDK Graveyard :: General, defect, P1)
Add-on SDK Graveyard
General
Tracking
(Not tracked)
RESOLVED
DUPLICATE
of bug 601295
1.0
People
(Reporter: irakli, Assigned: irakli)
References
Details
(Whiteboard: [sg:moderate] could lead to sg:critical mistakes in jetpacks)
Attachments
(1 file, 1 obsolete file)
At the moment all the content scripts do have an access to the `Components` object and there for to all the XPCOM capabilities due to the misbehavior of frameworks like jQuery if they are loaded in a sandbox with a non chrome privileges. This bug will help us not have that in mind.
Also I think that `new Cu.Sandbox(this._port.window)` may make a trick.
Comment 1•14 years ago
|
||
Still needed and important!
It make some jquery unit tests fails on bug 616946.
Assignee | ||
Comment 2•14 years ago
|
||
Comment for bug triage: I think it's important to have this fixed for 1.0 as users may start using chrome privileges from content scripts which is not only insecure but they will also break once this is fixed.
Updated•14 years ago
|
OS: Mac OS X → All
Priority: -- → P1
Hardware: x86 → All
Target Milestone: --- → 1.0b5
Assignee | ||
Updated•14 years ago
|
Assignee: nobody → rFobic
Assignee | ||
Comment 3•14 years ago
|
||
Adding dependency on 601295 as Alex made some fixes that partially resolves this issue.
Assignee | ||
Comment 4•14 years ago
|
||
Pointer to Github pull-request
Assignee | ||
Comment 5•14 years ago
|
||
Pointer to Github pull-request
Assignee | ||
Comment 6•14 years ago
|
||
Comment on attachment 526736 [details]
Pointer to Github pull request: https://github.com/mozilla/addon-sdk/pull/147#
This pull request is still work in progress as not all of the jQuery test pass.
Assignee | ||
Updated•14 years ago
|
Attachment #526736 -
Attachment is obsolete: true
Updated•14 years ago
|
Target Milestone: 1.0b5 → 1.0
Comment 7•14 years ago
|
||
Flagging as a security bug. This seems to be counter to the goals of JetPacks. Could lead to review mistakes if add-on reviewers assume page-mods are relatively safe because they're "sandboxed". Likely to leak privileged objects into page content if the page-mod script creates objects to enhance the page -- wrappers and compartments might help, but history says those can be bypassable.
Whiteboard: [sg:moderate] could lead to sg:critical mistakes in jetpacks
Assignee | ||
Comment 8•14 years ago
|
||
Marking this as a duplicate of 601295.
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•