See bug 1163109. We have a special case for resource:// workers loaded with the system principal where we give those workers the system principal so that they can do cross-site xhr. Maybe we don't need to do that any more?
I doubt I have the full context, but content with the "systemXHR" permission can use the mozSystem non-standard option to XHR: https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest#Non-standard_properties
I'm marking this sec-other because it sounds like there's no known security issue with this code.
Keywords: sec-other, sec-want
Jonas, what _is_ our exact security model for this stuff? Our worker security model still doesn't make sense to me....
I don't remember our rules for chrome workers. They are mostly there to make it harder for chrome code to XSS itself. I.e. it's there for similar reasons that we don't let data: URLs inherit chrome principals. IIRC dveditz had stronger opinions than I did about what exact rules we should have. Also, is there a reason we need to keep this bug closed?
> Also, is there a reason we need to keep this bug closed? I don't see one offhand.
You need to log in before you can comment on or make changes to this bug.