138308 - Pref to block images from third party servers doesn't block IFRAMES from thrid party servers

Status: RESOLVED DUPLICATE of bug 64066

(Core :: Graphics: Image Blocking, defect, P2)

Description

[Artem Saveliev]

Here's the javascript used:
http://ar.atwola.com/file/adsWrapper.js
The htmlAdWH function.

Looks like iframe image blocking issue.

Comment 1

[Mauricio Collares [:collares]]

those images are in different servers, you are probably blocking images from
'www.cnn.com', while the images are located in 'i.cnn.net',
'toolbar.netscape.com' and 'ar.atwola.com'

Comment 2

[Marcello Nuccio]

I cannot reproduce this bug in Moz1-RC1 for Linux. Reporter
([e-mail]), please can you check to see whether this bug is still
present in a recent build (Moz1-RC1 or a new nightly build). If this bug does
not occur please can you resolve it worksforme.

Please note that when you click in a image and block it, you're blocking the
server that sent the image, and when you use tools->image manager you're
blocking images from the server that sent the page.

Comment 3

[Artem Saveliev]

Hm... sorry for formulating subject wrong.
I am talking about "Accept images that come from originating server only" setting.
I don't block images manualy.

I just tested in RC1, same thing.

Comment 4

[Mauricio Collares [:collares]]

I am not sure if this is a bug, the page displayed in the IFRAME is served by
ar.atwola.com, the same server that sends the images...

Comment 5

[Artem Saveliev]

Yes, but iframe is displayed in www.cnn.com page.

I haven't found any bugs in Image Management component that have word iframe in
them.

Does it belong to some other component?

Comment 6

[Michael Lefevre]

hard to say, because the exact issue isn't clear, but this looks like a dupe of
bug 48660

Comment 7

[Mike Young]

this is not a dup of bug 48660 That is about issues with the image blocking code
and seperate servers.

This bug is simply about the fact that these pages are loading files in an
IFrame. This means that the Pref to block images from third party servers
doesn't matter because the IFrame's HTML is also coming from the third party server.

This is similar, but not quite a dup, of bug 64066.

Changing summary to reflect true meaning of this bug.


This would effectively be implemented as a security pref to "block IFRAMEs from
third party servers"

It wouldn't surprise me if the backend for this feature already existed with the
security code we have now, and we just need a front end to implement it. IE has
a similar feature to avoid navigating subframes across domains, but that has a
slightly different usage.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

Mass reassigning of Image manager bugs to [e-mail], and futuring.
Most of these bugs are enhancement requests or are otherwise low priority at
this time.

Comment 9

[Michiel van Leeuwen (email: mvl+moz@)]

This looks a lot like bug 64066. When the image manager blocks iframes, it will
also be possible to block third party iframes.

*** This bug has been marked as a duplicate of 64066 ***