148967 - Doodlepad does not work

Status: RESOLVED WORKSFORME

(Core :: Security, defect)

Description

[Christian :Biesinger (don't email me, ping me on IRC)]

Even with the patch for bug 8031, Doodlepad (see URL) doesn't work correctly,
the images aren't displayed.

Comment 1

[Hixie (not reading bugmail)]

Why should it? The images are sent back as text/html.

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

The images are not sent at all, but generated via Javascript... also, for <img
src>, imagelib ignores the content type afaik and sniffs the content

Comment 3

[Christian :Biesinger (don't email me, ping me on IRC)]

Actually... I get lots of "uncaught exception: Permission denied" messages,
after some "reference to undefined property" messages.

I'd suspect it's the site's fault... marking INVALID. reopen if you disagree.

Comment 4

[Ian Neal]

Maybe it should be put to Tech Evangelism rather than marked as invalid?

Comment 5

[Brendan Eich [:brendan]]

C'mon, this site should work as well as it did in 4.x (where it may have been
busted, but less so -- and not in the ability to generate XBMs via javascript:
URLs).  How about debugging why those exceptions are thrown?

/be

Comment 6

[Jacob Kjome]

It doesn't fully work in IE5.5, but the XBM images successfully load.  Seems
like it should work at least as good as it does in IE5.5.

jake

Comment 7

[Christian :Biesinger (don't email me, ping me on IRC)]

well the permission denied messages sound like the problem to me, -> security,
therefore

Comment 8

[Brendan Eich [:brendan]]

Could some kind soul get some stack backtraces of the security exceptions?  
Thanks,

/be

Comment 9

[Christian :Biesinger (don't email me, ping me on IRC)]

[clearing the priority and target milestone, I forgot to do that when I reassigned]

hm... venkman is not useful, it just says:
Exception ``Permission denied to get property Window.lineTool'' thrown from
function (null)() in <javascript:parent.lineTool> line 1.
and doesn't give any stack trace...