577606 - Personas that reference data: or resource: URIs cannot be installed.

Status: RESOLVED INACTIVE

(Toolkit :: Add-ons Manager, defect)

Description

[Christopher Finke]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.7) Gecko/20100701 Firefox/3.6.7
Build Identifier: 

Personas cannot be installed if they reference a data: URI for their headerURL or footerURL.  Full details and examples at http://www.chrisfinke.com/files/personas_data_uri_bug.html

Reproducible: Always

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Reprocuded with a 3.6.7pre build on OS X. Sadly I can't even see an error in the error console which could point to the problem.

Comment 2

[Christopher Finke]

FWIW, if you try to install a data URI persona from Chrome-priveleged code by calling LightWeightThemeWebInstaller._install(theme); directly, you get this error in the console:

Error: uncaught exception: 2147942487

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I wonder if we support data: URIs at all at the moment. Tony or Dao?

Comment 4

[Dão Gottwald [:dao]]

We don't.

Comment 5

[Christopher Finke]

Any tips on how to add support for data: URIs to personas? I can try and work out a fix myself, but I'm not at all familiar with any of the personas code.  (I'd like to update my True Colors extension to generate dynamic personas instead of manually specifying background images for various elements in chrome.)

Comment 6

[Matthew N. [:MattN]]

Attachment: v0.1 Allow data URIs but don't persist them on the filesystem

Comment 7

[Matthew N. [:MattN]]

Comment on attachment 586729 [details] [diff] [review]
v0.1 Allow data URIs but don't persist them on the filesystem

Review of attachment 586729 [details] [diff] [review]:
-----------------------------------------------------------------

::: toolkit/mozapps/extensions/LightweightThemeManager.jsm
@@ +647,5 @@
>  function _sanitizeTheme(aData, aBaseURI, aLocal) {
>    if (!aData || typeof aData != "object")
>      return null;
>  
> +  var resourceProtocols = ["http", "https", "data"];

For added security we could also test for data URIs that have the mediatype image/* since the default value is text/plain which wouldn't be useful.  I'm not sure if there are other types we want to support other than image/* though?

Comment 8

[Dão Gottwald [:dao]]

Comment on attachment 586729 [details] [diff] [review]
v0.1 Allow data URIs but don't persist them on the filesystem

This would store potentially large image data in the lightweightThemes.usedThemes preference... I'm concerned that this will stress the pref system too much, it surely wasn't meant for this kind of data :/

Comment 10

[Matthew N. [:MattN]]

(In reply to Dão Gottwald [:dao] from comment #8)
> This would store potentially large image data in the
> lightweightThemes.usedThemes preference... I'm concerned that this will
> stress the pref system too much, it surely wasn't meant for this kind of
> data :/

We probably need something like bug 866238 then.

Comment 11

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.