Just realized this. We now do same-compartment wrappers in WrapNewBindingObject, but we don't handle them in MaybeWrapValue. So if we have nodes coming out via "any" return values, we have a problem. :( I hate SOWs.

Comment on attachment 696371 [details] [diff] [review] Handle SOWs correctly in MaybeWrapValue. [Security approval request comment] How easily could an exploit be constructed based on the patch? Would need to find a WebIDL API returning "any" values that can include elements that might need SOWs. Not sure we have any offhand, and rather doubt we do, but would rather not risk it. Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? Sort of. Which older supported branches are affected by this flaw? Aurora 19 only. If not all supported branches, which bug introduced the flaw? Bug 801712. Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? Aurora backport attached to this bug. How likely is this patch to cause regressions; how much testing does it need?

Comment on attachment 696373 [details] [diff] [review] Aurora version of patch [Approval Request Comment] Bug caused by (feature/regressing bug #): Bug 801712. User impact if declined: Probably none, but possibly a security bug. Testing completed (on m-c, etc.): Seems to compile and pass tests Risk to taking this patch (and alternatives if risky): Low risk, I believe. String or UUID changes made by this patch: None.

Marking sec-high. Feel free to raise or lower as you feel is appropriate.

Hrm. I thought this had gotten sec-approval already, so I pushed http://hg.mozilla.org/integration/mozilla-inbound/rev/41920fe1eac1 but it looks like I was wrong... Backing it out now won't really help the problem, sadly. :( In any case, I think this should be a no-brainer for Aurora, and is absolutely required on m-c for 20.

Comment on attachment 696373 [details] [diff] [review] Aurora version of patch Approving for Aurora 19 (knowingly without sec-approval) since this has already landed on m-c.

Alex, thanks! http://hg.mozilla.org/releases/mozilla-aurora/rev/1b110c734937

Comment on attachment 696371 [details] [diff] [review] Handle SOWs correctly in MaybeWrapValue. Clearing sec-approval flag since this is already in.