I can get code to run with system principal on a victim's computer by if I can get him/her to send a message with a subject of my choice. (One way to do this would be to send a message with the code as the subject, and hope that the victim will reply to the message.) Sending a message with the following subject '); alert(Components.classes); (' causes this javascript code to run, and run with system principal. Here's the problematic code in sendProgress.js: //We need to delay the set title else dom will overwrite it return window.setTimeout( "SetTitle('" + subject + "');", 0 ); This seems to be part of code that sets the title of the "sending message: [subject]" dialog, because using a subject of b'+'lah results in that having "blah" in its title.

I'll mark PDT+ to get on PDT radar.

we need a good fix for this as soon as we can get it.

adding brendan and jst in case they can help.

accepting...

jesse, can you review the patch?

Great catch! r/sr=vidur for J-F's fix. Calls to eval() and new Function() might be other places where similar patterns could exist.

eval, Script or new Script or Script.prototype.compile, Function or new Function, are all callable ase setTimeout("...", t) is -- they all take a string and compile and possibly execute it. Beware. r/sr=brendan@mozilla.org on the patch. /be

a=chofmann

Fix checked in the branch, still need to check it in the trunk.

Fixed in the trunk too.

JFD, How do I verify this bug?

To verify: - Send a message to yourself with the subject '); alert(Components.classes); (' You should not get an alert, and there should be no errors on the JavaScript console. - Send a message to yourself with some interesting characters in the subject, such as ", ', :, \, <, and &. The subject should appear unmangled in the title of the "Sending message..." progress window, and there should be no errors on the JavaScript console.

verified based on comments above trunk builds: 2001070206-win98, mac, 2001062906 linux Branch builds: 2001070206 win98, mac, linux.

*** Bug 86613 has been marked as a duplicate of this bug. ***