158208 - window.open in address bar throws a security error

Status: RESOLVED WORKSFORME

(Core :: Security: CAPS, defect)

Description

[Jesse Ruderman]

Steps to reproduce: 
1. Go to http://www.mozilla.org/
2. Paste this url into the address bar and hit enter:
javascript:x=window.open("http://www.mozilla.org/"); alert(1); alert(x);

Result:
The window opens, but the rest of the javascript does not run and the variable x
is not set.  An error message appears in the javascript console: "Error:
uncaught exception: Security Error: Content at http://www.mozilla.org/ may not
load data from chrome://navigator/content/navigator.xul."

The same javascript code works as a bookmarklet in the personal toolbar, as a
javascript link in a page, or as an onclick handler for a <button> in a page.

I'm using 2002 071813 on Windows 2000.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

I'll look into it, but unless you're seeing this on a major website somewhere,
this is going to be low priority.

Comment 2

[Jesse Ruderman]

WFM in Mozilla 12/23 on Windows XP.