Bypasses Same Origin Policy checks via toDataURL()
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| WebApps: unity-chromium-extensions |
Fix Released
|
Undecided
|
Alexandre Abreu | ||
| WebApps: unity-firefox-extension |
Fix Released
|
Undecided
|
Maxim Ermilov | ||
| unity-chromium-extension (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| Quantal |
Fix Released
|
Undecided
|
Unassigned | ||
| unity-firefox-extension (Ubuntu) |
Fix Released
|
Undecided
|
Ken VanDine | ||
| Quantal |
Fix Released
|
Undecided
|
Unassigned | ||
| unity-webapps-amazoncloudreader (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| unity-webapps-facebookapps (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| unity-webapps-librefm (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| unity-webapps-pandora-com (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
| webapps-applications (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned | ||
Bug Description
This addon exposes a toDataURL() function to the web which allows content to convert an image (specified by a URL) to a data URI. It seems to work by drawing the image to a canvas and using the canvas.toDataURL() mechanism. However, this function seems to bypass all same-origin checks and returns valid data even if the image URL doesn't have the same origin as the document URL.
canvas.toDataURL() will throw a SecurityError exception if the canvas is not origin-clean. A canvas is not origin clean if you call ctx.drawImage() with a URL which does not have the same origin as the document that the canvas is in. However, the canvas used for the conversion is created in chrome context, so it has full privileges and the usual security mechanisms are bypassed completely.
[Test Case]
This can be reproduced with the following test case (I loaded this at http://
<html>
<head></head>
<body>
<p id="foo"/>
<script type="text/
window.external
});
</script>
</html>
In this example, you will see that toDataURL() throws as expected and an alert appears ("The operation is insecure"):
<html>
<head></head>
<body>
<p id="foo"/>
<script type="text/
var img = new Image();
var canvas = document.
var ctx = canvas.
img.onload = function() {
try {
} catch(e) { alert(e); }
};
img.src = "http://
</script>
</html>
[Regression Risks]
The fix consists mostly in removing code from the exposed API (toDataURL).
Related branches
- PS Jenkins bot (community): Approve (continuous-integration)
- WebApps: Pending requested
-
Diff: 66 lines (+25/-8)1 file modifiedunity-firefox-extension/content/unity-api.js (+25/-8)
- Alexandre Abreu (community): Approve
-
Diff: 66 lines (+23/-9)2 files modifiedchromium-extension/unity-api-page-proxy-builder-gen.js (+0/-4)
chromium-extension/unity-api.js (+23/-5)
CVE References
| Marc Deslauriers (mdeslaur) wrote | #1 |
| Changed in unity-firefox-extension (Ubuntu): | |
| assignee: | nobody → Ken VanDine (ken-vandine) |
| Marc Deslauriers (mdeslaur) wrote | #2 |
| Changed in unity-firefox-extension: | |
| assignee: | nobody → Maxim Ermilov (zaspire) |
| Changed in unity-firefox-extension: | |
| status: | New → Fix Committed |
| Marc Deslauriers (mdeslaur) wrote | #3 |
| information type: | Private Security → Public Security |
| Marc Deslauriers (mdeslaur) wrote | #4 |
| Changed in unity-chromium-extension: | |
| status: | New → Fix Committed |
| assignee: | nobody → Alexandre Abreu (abreu-alexandre) |
| Maxim Ermilov (zaspire) wrote | #5 |
| Alexandre Abreu (abreu-alexandre) wrote | #6 |
| description: | updated |
| Changed in unity-chromium-extension: | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote | #7 |
| Changed in unity-chromium-extension (Ubuntu): | |
| status: | New → Fix Released |
| Changed in unity-firefox-extension: | |
| status: | Fix Committed → Fix Released |
| Chris Halse Rogers (raof) wrote Please test proposed package | #8 |
| Changed in unity-chromium-extension (Ubuntu Quantal): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed |
| Marc Deslauriers (mdeslaur) wrote | #9 |
| Víctor R. Ruiz (vrruiz) wrote | #10 |
| Marc Deslauriers (mdeslaur) wrote | #11 |
| Víctor R. Ruiz (vrruiz) wrote | #12 |
| Didier Roche-Tolomelli (didrocks) wrote | #13 |
| Changed in unity-firefox-extension (Ubuntu): | |
| status: | New → Fix Committed |
| Changed in unity-firefox-extension (Ubuntu): | |
| status: | Fix Committed → Fix Released |
| no longer affects: | webapps-applications (Ubuntu Quantal) |
| Launchpad Janitor (janitor) wrote | #14 |
| Changed in unity-webapps-amazoncloudreader (Ubuntu): | |
| status: | New → Fix Released |
| Launchpad Janitor (janitor) wrote | #15 |
| Changed in unity-webapps-facebookapps (Ubuntu): | |
| status: | New → Fix Released |
| Launchpad Janitor (janitor) wrote | #16 |
| Changed in unity-webapps-librefm (Ubuntu): | |
| status: | New → Fix Released |
| Launchpad Janitor (janitor) wrote | #17 |
| Changed in unity-webapps-pandora-com (Ubuntu): | |
| status: | New → Fix Released |
| Launchpad Janitor (janitor) wrote | #18 |
| Changed in unity-firefox-extension (Ubuntu Quantal): | |
| status: | New → Fix Released |
| Launchpad Janitor (janitor) wrote | #19 |
| Changed in webapps-applications (Ubuntu): | |
| status: | New → Fix Released |
| Launchpad Janitor (janitor) wrote | #20 |
| Changed in unity-chromium-extension (Ubuntu Quantal): | |
| status: | Fix Committed → Fix Released |
This is CVE-2012-0958