138672 - Reading XML files cross-host with XSLT

Status: RESOLVED DUPLICATE of bug 113351

(Core :: Security, defect, P1)

Description

[Mitchell Stoltz (not reading bugmail)]

Check attached file xml4.xml and test2.xls - in it change 127.0.0.3 with 
the address of the web server. xml4.xml demonstrate 2 ways to read xml - 
directly and with HTTP redirect - re.pl is a cgi-bin which redirects to 
the query string.

With the growing importance of xml I believe xml should be subject to the
same origin policy the same way as html is.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Attachment: Demo - xml4.xml

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Attachment: test2.xsl

Comment 3

[Peter Van der Beken [:peterv]]

I'll take this.

Comment 4

[Peter Van der Beken [:peterv]]

*** Bug 145353 has been marked as a duplicate of this bug. ***

Comment 5

[Peter Van der Beken [:peterv]]

*** This bug has been marked as a duplicate of 113351 ***

Comment 6

[georgi - hopefully not receiving bugspam]

While the xml bugs are fixed in Mozilla 1.0, they are not fixed in the trunk
(nightlies). Someone please check the fixes in the trunk.