172557 - Plugins in mailnews not disabled when viewing msg as sanitized html

Status: VERIFIED INVALID

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Ere Maijala (slow)]

Using trunk build 2002100317 on Windows 2000. Disable plugins in Mail &
Newsgroups via preferences. View a HTML message with a link to a flash file or
similar (such as http://windward.nodalpoint.net/doc/media/liikenne.swf). Switch
message body view to simple HTML. Click on the link and it opens in the mail window.

Comment 1

[Ben Bucksch (:BenB)]

ere, please give an example source (preferably all different sources you tried).

Comment 2

[Olli Männistö]

Attachment: Message source with pdf attachment

This is a message source with attached pdf. Double-click on pdf attachment and
it opens inside the message window.

Comment 3

[Olli Männistö]

This "works" with original HTML, too.

Comment 4

[Ben Bucksch (:BenB)]

Then don't click on it. If you double-click an attachment, you explicitly
request to open it. That's what happens. Simple HTML mode is not intended
prevent that. It should only prevent plugins from loaing automatically, to
prevent from any bugs in the plugins being exploited via mail without user
invention (apart from clicking on the mail).

I'd think that it opens in a new window, but you say the Original HTML mode
behaves the same, so this has nothing to do with Simple HTML mode.

I got no answer about a testcase from ere either, and what he describes doesn't
sound all that wrong, so I'm closing this WONTFIX (close to INVALID).

Comment 5

[Ere Maijala (slow)]

Whoa, reopening. Forgot to give an example, will find one.

Comment 6

[Ere Maijala (slow)]

Ok, re-closing as invalid. When I submitted this, original HTML was opening the
flash plugin in a new window, but sanitized wasn't. Now it looks like they both
open in the mail window, so this one is invalid but another should be filed.

What I described sounded very wrong for me anyway. Plugins should not load the
message window even when I click a link or open an attachment. Besides being
just bad behavior, it ruins the character encoding. I think there is a bug about
this, and the suggested workaround was to disable plugins for MailNews..

Comment 7

[laurel]

marking verified