RequestPolicy/requestpolicy — Issue #257: whitelist bypass through certain javascript submitted forms
Author: jsamuel
Created: 2011-12-22 19:02:57+00:00
State: open
Labels: extension

imported trac ticket
created: 2011-09-04 10:16:01
reporter: justin

[https://grepular.com/ Mike Cardwell] has found another whitelist bypass. In certain situations, the approach RP is using to detect that a form was submitted by the user clicking a button (rather than by javascript) is unreliable. Mike provided me a PoC for this bypass.

I was quite saddened by this bug because I was not sure that there was a reliable way to differentiate user-initiated vs. javascript-initiated click/submit events. However, it appears that Gecko 2.0+ (Firefox 4+) provides an unforgable property on events, [https://developer.mozilla.org/en/DOM/event.mozInputSource mozInputSource], that provides such a way to differentiate these cases. I'm going to cross my fingers and poke a voodoo doll or two in the hope that this will work as well as it seems it might.