780047 - Prevent mozbrowsers from using PBrowser:CreateWindow

Status: RESOLVED FIXED

(Core :: IPC, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

This is a "legacy" interface we implemented for xul-fennec.  We should ensure that PBrowsers opened for mozbrowser treat those requests as malicious attacks.

Should block because I'm pretty sure OpenWindow is fully trusted and would allow bad things to happen ...

Comment 1

[Andrew Overholt [:overholt]]

Justin, could you be the owner here?

Comment 2

[Justin Lebar (not reading bugmail)]

Chris, there is no PBrowser::OpenWindow, nor did such a method ever exist, as far as I can tell.

Can you help me find the method you're referring to here?

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

http://mxr.mozilla.org/mozilla-central/source/dom/ipc/PBrowser.ipdl#79

Comment 4

[Justin Lebar (not reading bugmail)]

Attachment: Patch, v1

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Comment on attachment 655824 [details] [diff] [review]
Patch, v1

Now that xul-fennec is de-supported, I'd love to take a hatchet to this.  Except I think metro inherited all that code.

All the same, filing a followup on excising this would make me happy.

Comment 6

[Justin Lebar (not reading bugmail)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/e6cc3b189dcf

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/e6cc3b189dcf