This bug was fixed in the package unity-chromium-extension -
2.4.4-0ubuntu0.2
---------------
unity-chromium-extension (2.4.4-0ubuntu0.2) quantal-security; urgency=low
* New upstream release.
- No installation process triggered when a url matches more than one URL
in the list of available apps (LP: #1078325)
- Bypasses Same Origin Policy checks via toDataURL (LP: #1069817)
- Extension options page is broken & does not work (LP: #1076452)
- Race condition related to integration/install infobar (LP: #1068308)
- WebApps Unity plugin for Chromium keeps crashing (LP: #1070433)
-- Ken VanDine <[email protected]> Thu, 15 Nov 2012 15:23:34 -0500
** Changed in: unity-chromium-extension (Ubuntu Quantal)
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to unity-chromium-extension in Ubuntu.
https://bugs.launchpad.net/bugs/1069817
Title:
Bypasses Same Origin Policy checks via toDataURL()
Status in Chromium extension: Unity Integration:
Fix Released
Status in Firefox extension: Unity Integration:
Fix Released
Status in “unity-chromium-extension” package in Ubuntu:
Fix Released
Status in “unity-firefox-extension” package in Ubuntu:
Fix Released
Status in “unity-webapps-amazoncloudreader” package in Ubuntu:
Fix Released
Status in “unity-webapps-facebookapps” package in Ubuntu:
Fix Released
Status in “unity-webapps-librefm” package in Ubuntu:
Fix Released
Status in “unity-webapps-pandora-com” package in Ubuntu:
Fix Released
Status in “webapps-applications” package in Ubuntu:
Fix Released
Status in “unity-chromium-extension” source package in Quantal:
Fix Released
Status in “unity-firefox-extension” source package in Quantal:
Fix Released
Bug description:
This addon exposes a toDataURL() function to the web which allows
content to convert an image (specified by a URL) to a data URI. It
seems to work by drawing the image to a canvas and using the
canvas.toDataURL() mechanism. However, this function seems to bypass
all same-origin checks and returns valid data even if the image URL
doesn't have the same origin as the document URL.
canvas.toDataURL() will throw a SecurityError exception if the canvas
is not origin-clean. A canvas is not origin clean if you call
ctx.drawImage() with a URL which does not have the same origin as the
document that the canvas is in. However, the canvas used for the
conversion is created in chrome context, so it has full privileges and
the usual security mechanisms are bypassed completely.
[Test Case]
This can be reproduced with the following test case (I loaded this at
http://localhost/test.html):
<html>
<head></head>
<body>
<p id="foo"/>
<script type="text/javascript">
window.external
.getUnityObject(1)
.toDataURL("http://www.ubuntu.com/sites/default/themes/ubuntu10/images/footer_logo.png";,
function(a, b) {
document.getElementById("foo").innerHTML = b;
});
</script>
</html>
In this example, you will see that toDataURL() throws as expected and
an alert appears ("The operation is insecure"):
<html>
<head></head>
<body>
<p id="foo"/>
<script type="text/javascript">
var img = new Image();
var canvas = document.createElement('canvas');
var ctx = canvas.getContext('2d');
img.onload = function() {
try {
ctx.drawImage(img, 0, 0);
document.getElementById("foo").innerHTML = canvas.toDataURL();
} catch(e) { alert(e); }
};
img.src =
"http://www.ubuntu.com/sites/default/themes/ubuntu10/images/footer_logo.png";;
</script>
</html>
[Regression Risks]
The fix consists mostly in removing code from the exposed API (toDataURL).
To manage notifications about this bug go to:
https://bugs.launchpad.net/unity-chromium-extension/+bug/1069817/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
![http://www.ubuntu.com/sites/default/themes/ubuntu10/images/footer_logo.png"](http://www.ubuntu.com/sites/default/themes/ubuntu10/images/footer_logo.png"){kind=link}