Fix vulnerability due to overflow of CSS beyond container boundary

It is possible to craft guest code creating visible content outside
the boundary of the double-DIV sandbox enforced by Caja. For example:

  <div style="margin-left:-150px;margin-top:0px;width:110px;">
    <div>Phishing content</div>
  </div>

This was introduced at r4374 due to the removal of a CSS property
"overflow: hidden" in the caja.js styling of the container DIVs.

This vulnerability allows guest content authors to overlay and mimic
the user interface of surrounding container content, and thus attempt
to phish the end-user into entering into the guest content information
that would normally only be revealed to the container.

See http://code.google.com/p/google-caja/issues/detail?id=1442

[Jasvir, 2012-01-12 23:43:58]

LGTM

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
File tests/com/google/caja/plugin/ES53BrowserTest.java (right):

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
tests/com/google/caja/plugin/ES53BrowserTest.java:192:
runTestDriver("es53-test-container-overflow.js", false);
s/, false//

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
File tests/com/google/caja/plugin/browser-test-case.html (right):

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
tests/com/google/caja/plugin/browser-test-case.html:39: <div
id="automatedTestingReadyIndicator" style="display: none;"></div>
Why?

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
File tests/com/google/caja/plugin/es53-test-container-overflow.js (right):

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
tests/com/google/caja/plugin/es53-test-container-overflow.js:63: x: ((r.left +
r.right) / 2),
Cool - these include any padding and margins.

[ihab.awad, 2012-01-12 23:49:01]

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
File tests/com/google/caja/plugin/ES53BrowserTest.java (right):

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
tests/com/google/caja/plugin/ES53BrowserTest.java:192:
runTestDriver("es53-test-container-overflow.js", false);
On 2012/01/12 23:43:59, Jasvir wrote:
> s/, false//

Unfortunately not, because we don't have full Domado layout for ES5 mode.

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
File tests/com/google/caja/plugin/browser-test-case.html (right):

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
tests/com/google/caja/plugin/browser-test-case.html:39: <div
id="automatedTestingReadyIndicator" style="display: none;"></div>
On 2012/01/12 23:43:59, Jasvir wrote:
> Why?

To make the layout more predictable. I want the one and only DIV the test adds
to be predictably at (0, 0) and of the proper size. Then I check to make sure
the visible browser window is at least (25, 25) in side. Under those conditions,
if the guest code manages to spill over its phishing DIV, my test code is sure
to see it.

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
File tests/com/google/caja/plugin/es53-test-container-overflow.js (right):

http://codereview.appspot.com/5540049/diff/2001/tests/com/google/caja/plugin/...
tests/com/google/caja/plugin/es53-test-container-overflow.js:63: x: ((r.left +
r.right) / 2),
On 2012/01/12 23:43:59, Jasvir wrote:
> Cool - these include any padding and margins.

Done.

[ihab.awad, 2012-01-16 23:35:24]

Fixed in r4761.