148465 - add wyciwyg:// protocol to CheckLoadURI

Status: RESOLVED FIXED

(Core :: Security: CAPS, defect)

Description

[Mitchell Stoltz (not reading bugmail)]

We need to add the wyciwyg: protocol to the CheckLoadURI function's protocol
list. It should be treated as local data, like file:.

Comment 1

[Jesse Ruderman]

A wyciwyg url should be treated by the security manager as being the same as its
source.  For example, wyciwyg://2/http://localhost/foo/ came from
http://localhost/foo/.  This seems to work already: in the JS console, I see
"Content at http://localhost/foo/ may not load or link to file:///c%7C/" even
though foo/index.html has rewritten itself using document.write.

See also bug 123293, we send bogus referrers from wyciwyg URLs.

Comment 2

[Scott A. Colcord]

Note that this bug breaks Replicon's (http://www.replicon.com/) Web TimeSheet
program when it's run from a secure server (program functions, but gives
security warnings/broken (red) lock icon).

Comment 3

[Mitchell Stoltz (not reading bugmail)]

This bug may be causing the warnings, but it's not causing the red lock icon.

Comment 4

[Boris Zbarsky [:bzbarsky]]

This is now fixed, as a result of the checkins for bug 387333 (1.8 branch) and bug 120373 (trunk).