1135934 - [e10s] "View Background Image" and "View Description" in remote browser cause unsafe CPOW usage warning

Status: RESOLVED FIXED

(Firefox :: Menus, defect)

Description

[Ian Moody [:Kwan] (UTC+0)]

+++ This bug was initially created as a clone of Bug #1133577 +++

STR:

1) Visit a site with a background image on it in an e10s window
2) Right-click on the page, and choose "View Background Image"

This causes some "unsafe CPOW usage" warnings in the Browser Console.

In browser/base/content/nsContextMenu.js:

  // Change current window to the URL of the background image.
  viewBGImage: function(e) {
    urlSecurityCheck(this.bgImageURL,
                     this.browser.contentPrincipal,
                     Ci.nsIScriptSecurityManager.DISALLOW_SCRIPT);
    var doc = this.target.ownerDocument; <-- Causes CPOW warning
    openUILink(this.bgImageURL, e, { disallowInheritPrincipal: true,
                                     referrerURI: doc.documentURIObject }); <-- Causes CPOW warning
  },


in toolkit/modules/RemoteWebNavigation.jsm

  loadURI: function(aURI, aLoadFlags, aReferrer, aPostData, aHeaders) {
    if (aPostData || aHeaders)
      throw Components.Exception("RemoteWebNavigation doesn't accept postdata or headers.", Cr.NS_ERROR_INVALID_ARGS);

    this._browser._contentTitle = "";
    this._sendMessage("WebNavigation:LoadURI", {
      uri: aURI,
      flags: aLoadFlags,
      referrer: aReferrer ? aReferrer.spec : null <-- Causes CPOW warning
    });
  },

Comment 1

[Ian Moody [:Kwan] (UTC+0)]

Morphing to include "View Description" (on images) since they are both only making the one mistake of accessing this.target.ownerDocument.documentURIObject, and so are both now simple fixes.

Comment 2

[Ian Moody [:Kwan] (UTC+0)]

Attachment: Make "View Background Image" and "View Description" use gContextMenuContentData to avoid unsafe CPOW warnings

Comment 3

[Mike Conley (:mconley) (:⚙️)]

Comment on attachment 8574415 [details] [diff] [review]
Make "View Background Image" and "View Description" use gContextMenuContentData to avoid unsafe CPOW warnings

Review of attachment 8574415 [details] [diff] [review]:
-----------------------------------------------------------------

Looks great!

Comment 4

[Ian Moody [:Kwan] (UTC+0)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=1d9150de2dc0

Linux and Windows green, OSX tests, so, so busted, but that's nothing to do with me.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/fx-team/rev/c726d51bffd1

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c726d51bffd1