656823 - Loading data: URLs from bookmarks shouldn't inherit principal

Status: RESOLVED DUPLICATE of bug 1324406

(Firefox :: General, defect)

Description

[Jesse Ruderman]

1. In the address bar, enter 
  data:text/html,<script>alert(document.cookie)</script>

Result: shows Bugzilla cookie

Expected: show empty alert

(Figuring out what to do for *javascript:* URLs is controversial and covered in other bugs.)

(Changing the behavior of data: *links in web pages* is controversial and covered in other bugs.)

Comment 1

[Boris Zbarsky [:bzbarsky]]

Gavin has a fix for the url bar case.

Comment 2

[Jesse Ruderman]

Gavin's patch in bug 656433 fixes the address bar case.

Comment 3

[:Gavin Sharp [email: [e-mail]]]

(In reply to comment #0)
> Result: shows Bugzilla cookie
> 
> Expected: show empty alert

Note that the patch in bug 656433 has slightly different expected results: no alert appears, because window.alert is undefined (there is no window object).

Comment 4

[Jesse Ruderman]

That sounds quite strange. How does the data: document end up without a window object?

Comment 5

[Boris Zbarsky [:bzbarsky]]

Gavin: that sounds odd.  for javascript:, maybe, but data: should do the right thing.

Comment 6

[:Gavin Sharp [email: [e-mail]]]

Yes, sorry, I was confusing data: and javascript:. data: URIs show the alert, javascript: URIs don't.

Comment 8

[:Gijs (he/him)]

Christoph, this is fixed now, right? Can you mark this as a dep on the bug that fixed this?

Comment 9

[Christoph Kerschbaumer [:ckerschb]]

(In reply to :Gijs from comment #8)
> Christoph, this is fixed now, right? Can you mark this as a dep on the bug
> that fixed this?

Let's mark it as a duplicate.