1389163 - security error loading draft with embedded image

Status: RESOLVED INVALID

(Thunderbird :: Message Compose Window, defect)

Description

[Jonathan Kamens]

With 2017-08-10 daily build:

1. Compose a new message.
2. Paste an embedded image directly into the message body.
3. Save the draft and close the compose window.
4. Double click on the draft to open a new compose window containing it.
5. Observe an error like this in the error console:

Security Error: Content at moz-nullprincipal:{2a48b626-ad0e-41d4-9aa8-96a139dafb6b} may not load or link to imap://[username]@[hostname]:993/fetch%3EUID%3E.Drafts%3E6006?part=1.2&filename=kpjmhppfbkkjjoah.png.

The draft still loads with the embedded image in it, but I'm pretty sure the error above shouldn't be happening and is going to bite us at some point soon (in fact, I'm chasing down other related image loading issues that may be related to this error, though I haven't fully tracked them down yet).

Comment 1

[Jorg K (CEST = GMT+2)]

No. We block content and load it via the error event.

https://dxr.mozilla.org/comm-central/rev/d2b81af84925c478d9a7c2ef888351e1ba9b5fce/mail/components/compose/content/MsgComposeCommands.js#5396

It's Magnus' tricky implementation.

Comment 2

[Jonathan Kamens]

OK, so, I get how this might be the only practical solution to this problem right now, but surely it is problematic when errors appear in the error console in response to entirely normal and expected behavior?

There is an awful lot of noise from Thunderbird in both the error console and program output. This makes it difficult to discern real problems from red herrings.