1253179 - Unwanted content still loaded using javascript URI scheme (spoof)

Status: NEW

(Core :: DOM: Navigation, defect, P3)

Description

[Paul Silaghi, QA [:pauly]]

[Note]:
- follow-up of bug 1228754

[Affected versions]:
- 45, 46.0a2 (2016-03-02), 47.0a1 (2016-03-02)

[Affected platforms]:
- all

[Steps to reproduce]:
1. Open https://bugzilla.mozilla.org/attachment.cgi?id=8695015 (testcase in bug 1228754)
2. Press on "Click here"

[Expected result]:
- about:blank should be displayed
- no content should be loaded (see Google Chrome's behavior)

[Actual result]:
- about:blank is displayed
- unwanted content is loaded

[Regression range]:
- not a regression

Comment 1

[:Gijs (back August 25; he/him)]

How do IE, Edge and Safari behave? How does Chrome behave if you turn off the XSS filter, if that's possible?

Comment 2

[Paul Silaghi, QA [:pauly]]

IE 11: location bar -> https://login.google.com/
       content: This page can’t be displayed
Safari: location bar -> https://login.google.com/
        content: Safari can't find the server
Edge: location bar -> https://bug1228754.bmoattachments.org/attachment.cgi?id=8695015&t=zIzvKDc9XyXcXUhefFHHF8
      content: white page
Chrome: location bar -> https://bug1228754.bmoattachments.org/attachment.cgi?id=8695015&t=zIzvKDc9XyXcXUhefFHHF8
      content: initial "Click here" page
Same results if starting Chrome with --disable-xss-auditor, but I think the option did nothing, from what I've read it is no longer possible to disable the filter starting with Chrome 42.

Comment 3

[:Gijs (back August 25; he/him)]

This needs more investigation to be useful, but it is at least not a location bar bug. It's not clear to me under what conditions the other browsers display a blank page and what is different in Gecko in that respect.

Comment 4

[Andrew Overholt [:overholt]]

This feels related to bug 1251028. I'll needinfo smaug here since he's been looking there.