177237 - [FIXr]checking the base uri for security checks is bogus...

Status: RESOLVED FIXED

(Core :: Security, defect, P1)

Description

[Boris Zbarsky [:bzbarsky]]

nsHTMLFormElement and nsScriptLoader have these bogus security checks....

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: fix

Comment 2

[Boris Zbarsky [:bzbarsky]]

hmm.... as bbaetz just pointed out, you can't set the base url to something you
could not link to anyway... so perhaps this is a non-issue.... (if it _is_ an
issue, we should fix the CSSLoader as well).

Comment 3

[Boris Zbarsky [:bzbarsky]]

We need to decide on what the right thing is so I can fix the remaining
(correctness) problem in bug 171924

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 104455 [details] [diff] [review]
fix

This seems right to me. No matter what you set the base to (even if you're
allowed to set it to whatever URI you're setting it to), the security checks
should IMO use the document URI since that's who's really loading the data, or
whatever.

sr=jst, Mitch, you ok with this?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: add CSSLoader to the list of victims

This just adds the last chunk for CSSloader...

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Comment on attachment 104908 [details] [diff] [review]
add CSSLoader to the list of victims

Yes, this looks more correct. r=mstoltz.

Comment 7

[Christopher Blizzard (:blizzard)]

Comment on attachment 104908 [details] [diff] [review]
add CSSLoader to the list of victims

a=blizzard on behalf of drivers for 1.2final.

Make sure you get this in by the tree closure on Nov 5th, 2002.  If you don't,
it's going to have to wait until the branch is finished being cut.

Comment 8

[Boris Zbarsky [:bzbarsky]]

checked in