moz_bug_r_a4 Reporter
	Description • 12 years ago

When there is no frame, GetCxSubjectPrincipalAndFrame can return the wrong principal, thus it's possible to spoof document.referrer.

This is a regression from bug 754202. (fx16,17,18 are affected.)

Note: bug 797204 fixed this bug on trunk, but, currently the testcase for this bug also works on trunk due to bug 810808.

	moz_bug_r_a4 Reporter
	Comment 1 • 12 years ago

This is used to show document.referrer.

	moz_bug_r_a4 Reporter
	Comment 2 • 12 years ago

This works on fx16,17,18 (and trunk due to bug 810808).

	Johnny Stenback (:jst)
	Comment 3 • 12 years ago

bholley, how close to bug 810808 is this one? Close enough to dupe? Or different enough to keep separate?

	Bobby Holley (:bholley) Assignee
	Comment 4 • 12 years ago

(In reply to Johnny Stenback (:jst, jst@mozilla.com) from comment #3)
> bholley, how close to bug 810808 is this one? Close enough to dupe? Or
> different enough to keep separate?

The exploits affect different branches, but the eventual fix will be the same.

	Bobby Holley (:bholley) Assignee
	Comment 5 • 10 years ago

I think we can now dupe this to bug 810808.