57414 - data: page can't window.open and then document.write twice

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Jesse Ruderman]

Steps to reproduce:
1. Run Mozilla with -console to see error messages
2. Load data:text/html,quux
3. Type into urlbar: javascript:with(window.open("about:blank").document){write
("foo"); write("bar");}

The code works fine at http urls, file urls, and about:blank, but at 
data:text/html urls, the second write() fails with 
NS_ERROR_DOM_PROP_ACCESS_DENIED.  I get the same results using the script as a 
url in the urlbar, as a personal toolbar bookmarklet, as a javascript: link in 
the data page, or as a <script> in the data page.


This equivalent code will fail under the same circumstances and may be easier 
to use for debugging:

javascript:x=window.open("about:blank").document;x.write("foo");x.write("bar");


I noticed the problem while using the DOM property tree bookmarklet at 
http://www.cs.hmc.edu/~jruderma/mozilla/proptree/ as a personal toolbar link.

Comment 1

[Jesse Ruderman]

Same thing happens when you start at a javascript: url instead of a 
data:text/html url (for example, javascript:4).

Comment 2

[John Unruh]

Mass changing QA to ckritzer.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Mass changing milestones to Moz0.9.1. Many of these bugs are dependent on the
XPConnected DOM and its associated security UI changes.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

I can't reproduce this anymore, so I guess it's fixed.

Comment 5

[ckritzer (gone)]

Currently blocked by bug#82159

Comment 6

[ckritzer (gone)]

Marking VERIFIED FIXED on:
-MacOS91 2001-06-01-08-trunk
-Win98SE 2001-06-01-06-trunk
-LinRH62 2001-06-01-08-trunk