Open
Bug 1003759
Opened 11 years ago
Updated 2 years ago
Reject loading special URIs in arbitrary content contexts.
Categories
(Core :: DOM: Navigation, defect)
Core
DOM: Navigation
Tracking
()
NEW
People
(Reporter: bobowen, Unassigned)
References
Details
This is a follow-up to bugs 973837 and 624883, which block view-source when the browsing context is not top level.
The current checks in the fixes for these two bugs are in nsObjectLoadingContent::LoadObject and nsDocShell::DoURILoad.
It would be good if these could be done in a different common place, for example Content Policy or its planned replacement.
Currently the way Content Policy is checked in docshell makes it difficult to redirect to the "Unknown protocol" error page, which was the desired behaviour for bug 624883.
We could also include checks for other special URIs (e.g. chrome://).
See comments in bug 973837 for details.
|
||
Updated•2 years ago
|
Severity: minor → S4
You need to log in
before you can comment on or make changes to this bug.
Description
•