(In reply to Boris Zbarsky [:bzbarsky, bz on IRC] from comment #6) > So if we remove that bit we should just remove all of https://searchfox.org/mozilla-central/rev/11712bd3ce7454923e5931fa92eaf9c01ef35a0a/dom/base/nsContentUtils.cpp#6499-6511 My current removal preserves the security.fileuri.strict_origin_policy=false case, buried in the call to nsScriptSecurityManager::SecurityCompareURIs just above the bit I removed. A bunch of tests seem to use that. Not sure I'm ready to break that case, especially since that was going to be my recommendation to anyone we break who's depending on the current behavior.
Bug 1500453 Comment 9 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
(In reply to Boris Zbarsky [:bzbarsky, bz on IRC] from comment #6) > So if we remove that bit we should just remove all of https://searchfox.org/mozilla-central/rev/11712bd3ce7454923e5931fa92eaf9c01ef35a0a/dom/base/nsContentUtils.cpp#6499-6511 My current removal preserves the security.fileuri.strict_origin_policy=false case, buried in the call to nsScriptSecurityManager::SecurityCompareURIs just above the bit I removed. A bunch of tests seem to use that. Not sure I'm ready to break that case, especially since that was going to be my recommendation to anyone we break who's depending on the current behavior. > I don't think we can really keep the navigation inheritance bits working if we actually want to prevent things like "load the other file in an iframe and then read it", at least for a bunch of file formats.... I definitely don't want to keep that working, just wanted to make sure I wasn't missing a chunk of code if it was implemented using different checks.