Issue metadata
Sign in to add a comment
|
Security: PDFs can navigate to file:-URLs |
||||||||||||||||||||||
Issue descriptionChrome version: 53.0.2785.116 (stable) and latest (56.0.2886.0). 1. Open attached PDF. 2. Ctrl-click on the PDF file (middle-mouse and shift also work in Chrome 54 onwards thanks to bug 630075 ). 3. Observe that file:///tmp/ is being opened (as an example). This is like bug 533520 , except with key modifiers.
,
Oct 10 2016
Severity medium per previous bug with these consequences.
,
Oct 10 2016
,
Oct 11 2016
,
Oct 14 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/374249e767a68d8da073a4ed3a4f29236451174c commit 374249e767a68d8da073a4ed3a4f29236451174c Author: rob <rob@robwu.nl> Date: Fri Oct 14 10:13:14 2016 Add check for file:-navigations from PDFs BUG= 654279 TEST=./browser_tests --gtest_filter=PDFExtensionTest.Navigator CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation Review-Url: https://codereview.chromium.org/2402873002 Cr-Commit-Position: refs/heads/master@{#425287} [modify] https://crrev.com/374249e767a68d8da073a4ed3a4f29236451174c/chrome/browser/resources/pdf/navigator.js [modify] https://crrev.com/374249e767a68d8da073a4ed3a4f29236451174c/chrome/browser/resources/pdf/pdf.js [modify] https://crrev.com/374249e767a68d8da073a4ed3a4f29236451174c/chrome/test/data/pdf/navigator_test.js
,
Oct 14 2016
,
Oct 15 2016
,
Oct 17 2016
,
Oct 17 2016
Your change meets the bar and is auto-approved for M55 (branch: 2883)
,
Oct 17 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c337558010508f6e27594e2683ddcf2f8813fc89 commit c337558010508f6e27594e2683ddcf2f8813fc89 Author: Rob Wu <rob@robwu.nl> Date: Mon Oct 17 11:54:00 2016 Add check for file:-navigations from PDFs BUG= 654279 TEST=./browser_tests --gtest_filter=PDFExtensionTest.Navigator CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation Review-Url: https://codereview.chromium.org/2402873002 Cr-Commit-Position: refs/heads/master@{#425287} (cherry picked from commit 374249e767a68d8da073a4ed3a4f29236451174c) Review URL: https://codereview.chromium.org/2424783002 . Cr-Commit-Position: refs/branch-heads/2883@{#146} Cr-Branched-From: 614d31daee2f61b0180df403a8ad43f20b9f6dd7-refs/heads/master@{#423768} [modify] https://crrev.com/c337558010508f6e27594e2683ddcf2f8813fc89/chrome/browser/resources/pdf/navigator.js [modify] https://crrev.com/c337558010508f6e27594e2683ddcf2f8813fc89/chrome/browser/resources/pdf/pdf.js [modify] https://crrev.com/c337558010508f6e27594e2683ddcf2f8813fc89/chrome/test/data/pdf/navigator_test.js
,
Oct 18 2016
,
Oct 27 2016
,
Oct 27 2016
$1,000 for this report - many thanks!
,
Oct 27 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c337558010508f6e27594e2683ddcf2f8813fc89 commit c337558010508f6e27594e2683ddcf2f8813fc89 Author: Rob Wu <rob@robwu.nl> Date: Mon Oct 17 11:54:00 2016 Add check for file:-navigations from PDFs BUG= 654279 TEST=./browser_tests --gtest_filter=PDFExtensionTest.Navigator CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:closure_compilation Review-Url: https://codereview.chromium.org/2402873002 Cr-Commit-Position: refs/heads/master@{#425287} (cherry picked from commit 374249e767a68d8da073a4ed3a4f29236451174c) Review URL: https://codereview.chromium.org/2424783002 . Cr-Commit-Position: refs/branch-heads/2883@{#146} Cr-Branched-From: 614d31daee2f61b0180df403a8ad43f20b9f6dd7-refs/heads/master@{#423768} [modify] https://crrev.com/c337558010508f6e27594e2683ddcf2f8813fc89/chrome/browser/resources/pdf/navigator.js [modify] https://crrev.com/c337558010508f6e27594e2683ddcf2f8813fc89/chrome/browser/resources/pdf/pdf.js [modify] https://crrev.com/c337558010508f6e27594e2683ddcf2f8813fc89/chrome/test/data/pdf/navigator_test.js
,
Oct 28 2016
,
Nov 1 2016
(not merged, budroid comment is wrong - https://groups.google.com/a/chromium.org/d/msg/chromium-dev/sJ7gZLqyJ-g/k-CbRUrnBwAJ)
,
Nov 7 2016
,
Nov 29 2016
,
Jan 4 2017
,
Jan 21 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Apr 25 2018
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by rob@robwu.nl
, Oct 9 2016Owner: rob@robwu.nl
Status: Started (was: Unconfirmed)