209029 - Boomarklet opening Bugzilla erroneously sends a referer

Status: RESOLVED DUPLICATE of bug 122668

(SeaMonkey :: Bookmarks & History, defect)

Description

[Daniel Glazman (:glazou) (not active in Mozilla any more)]

1. start Mozilla
2. add the following bookmarklet to your personal bookmark toolbar

   name of bookmark: bugzilla
   url: javascript:aa=prompt(%22File
Name?%22,%22%22);window.location=%22http://bugzilla.mozilla.org/show_bug.cgi?id=%22+aa;void(0)

3. open URL http://www.slashdot.org/
4. click on bookmarklet in personal bookmark toolbar and enter a bug number
   for instance 137092

Expected result : bugzilla bug 137092 displayed
Actual result: message "Sorry, links to Bugzilla from Slashdot are disabled."

Since the bugzilla bug is not downloaded by a click in the slashot page, the
slashot referer should probably not be included in the request...

Comment 1

[Boris Zbarsky [:bzbarsky]]

Bookmarklets just execute in the JS context of the page.  There is no way to
tell a bookmarklet apart from typing the javascript: url in the URL bar, and no
way to tell either apart from the page itself executing some JS.

The JS context thing is necessary for the bookmarklet to have access to the page
DOM (if it's not in the JS context of the page, and not running as chrome, the
security system blocks it).

Running bookmarklets as chrome has been discussed, but it would open such huge
gaping security holes (via trivial social engineering) that it was decided against.

Comment 2

[u60234]

Dupe of bug 122668?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Yup.

*** This bug has been marked as a duplicate of 122668 ***