53124 - [FIXr]location.host fails for pages loaded from jar

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Mitchell Stoltz (not reading bugmail)]

If a page was loaded from the jar protocol, accessing document.location.host
fails and stops the script. This is because nsJARURI::GetHost always returns
failure. Since Warren insists this is the correct behavior, the alternative is
to special-case JAR URLs in nsLocation.

This feature is important for security. In order to prevent a signed script from
being copied to another site, a script must check document.location.host to see
what host the script is being run from.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Warren, jband and I talked this over. I think the consensus was for a special-
case solution in DOM rather than changing the behavior of nsJARURI. However, we 
can live without this for now. Marking Future.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

performance, footprint, feature work, and re-architecture bugs will be addressed
in 0.9.8

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Future

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Possible patch

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 146733 [details] [diff] [review]
Possible patch

So assuming we still want to do this, I think this is the way to do it...  I
just changed host, hostname, and port.	The rest should come from the jar URI
itself.

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 146733 [details] [diff] [review]
Possible patch

sr=jst

Comment 7

[Darin Fisher]

Comment on attachment 146733 [details] [diff] [review]
Possible patch

r=darin, but...

what about a jar file contained in a jar file loaded from a http site?	what
should happen in that case?  should you loop?  also, what about wyciwyg?  i
also thought it would be nice if we had a nsILayeredURI or something like that
that could be used to generalize the concept of a URI containing an inner URI.

Comment 8

[Boris Zbarsky [:bzbarsky]]

> what about a jar file contained in a jar file loaded from a http site?
> what should happen in that case?  should you loop?

At the moment, I loop.  Given the original intent of this bug, that seemed like
the most reasonable thing to do.

> also, what about wyciwyg?

What about it?  At the moment, CreateExposableURI makes it happy.  If we have
wyciwyg://x/jar:whatever, we run into trouble, I guess....

> it would be nice if we had a nsILayeredURI or something like that

That may in fact be a good idea...  Want to file a bug on that?

Comment 9

[Boris Zbarsky [:bzbarsky]]

Checked in.  jst, is this something we want on the 1.7 branch?

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 146733 [details] [diff] [review]
Possible patch

I'd say we do want this on the next stable branch, otherwise it doesn't help
the implementors who need this all that much.

Looks safe, is there a reason NOT to take it in 1.7?

Comment 11

[Boris Zbarsky [:bzbarsky]]

Not that I know of.

Comment 12

[Asa Dotzler [:asa]]

Comment on attachment 146733 [details] [diff] [review]
Possible patch

a=asa (on behalf of drivers) for checkin to 1.7

Comment 13

[Boris Zbarsky [:bzbarsky]]

Checked in on the 1.7 branch.