224504 - (JS) "Error: uncaught exception: Permission denied to get property UnnamedClass.classes", when accessing 'Components.classes' from a non-<chrome://> URL

Status: RESOLVED WORKSFORME

(Core :: Security: CAPS, defect)

Description

[Myk Melez [:myk] [@mykmelez]]

Attempts to access Components.classes from a script at a file:/// URL fail with
the message "Permission denied to get property UnnamedClass.Classes".  To see
this in action, save the forthcoming testcase to your local drive and load it in
Mozilla.  If the file is added to a registered chrome subdirectory and loaded
via a chrome: URL, everything works.

I tested on Mozilla 1.5, Firebird 0.7, and the latest Mozilla nightly
(2003-11-02-05), all on Linux.

Comment 1

[Myk Melez [:myk] [@mykmelez]]

Attachment: testcase that throws error if attempt to access fails

Comment 2

[Serge Gautherie (:sgautherie)]

[Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.6a) Gecko/20031030]
(BuildId=2003110115, bug 224340#c19) (W98SE)

Confirming on W98:
As a testcase, (Ctrl-)clicking on your attachment directly from BugZilla is
enough to get the error !

I noticed this error while trying to convert a (.xul) window to a dialog:
the window works as expected,
the dialog generates the error while it's loading/opening.

I'll attach the two .xul files as a testcase:
I open them from the JS.D. (JS.C. could do too) with:
{
window.open("file:///R:/!Drive_X/Mozilla/Cvs/Checkout/mozilla/profile/pref-migrator/resources/content/donothingSG_D.xul",
"SGtestDN0", "dialog,chrome,centerscreen,modal,titlebar");
}
Of course, the error is there, even with an empty parameter string.

*Changing:
 *OS: Linux -> All.
 *(S) Normal -> Major, as "uncaught exception".

Comment 3

[Serge Gautherie (:sgautherie)]

Attachment: (Comment 2) Window testcase (all right)

Comment 4

[Serge Gautherie (:sgautherie)]

Attachment: (Comment 2) Dialog testcase (error)

This is an over-simplified testcase based on
<http://www.xulplanet.com/tutorials/xultu/examples/ex_11_2_1.xul> !

Comment 5

[Serge Gautherie (:sgautherie)]

From the URL in comment 4, (and the BugZilla attachment links)

<http://> is affected, as <file:///> is:
only <chrome://> passes !

On Google, I found:
*2 other cases:
(09/15/2002) http://www.geocrawler.com/archives/3/137/2002/9/0/9603266/
(05/27/2003) http://www.geocrawler.com/archives/3/125/2003/5/0/10497032/
*1 IRC log (timeless, neil, ...), dated 2002-12-03 (!):
http://www.pseudorandom.org/irclog/mozilla/%23mozilla/%23mozilla.2002-12/%23mozilla.2002-12-03.log

This bug seems to exist for at least more than a year: != recent.

By itself, getting this error in the XulPlanet tutorial is rather bad :-(

Comment 6

[Serge Gautherie (:sgautherie)]

Comment on attachment 135518 [details]
(Comment 2) Dialog testcase (error)

Also, note that when opened  from outside <chrome://>:
*The two buttons appears without labels.
*The Cancel button has no effect.

Theses are consequences of this bug, aren't they ?

Comment 7

[Ken Johanson]

Hmm, I wonder if this bug has some relation to bug #248402.

Comment 8

[timeless]

you need to run with -chrome, or setup permission to ask for permission to use 
xpconnect (and then ask)

Comment 9

[Serge Gautherie (:sgautherie)]

How the error message improved over time:

[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.13) Gecko/20060414] (release) (W2Ksp4)
[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.12) Gecko/20070510 SeaMonkey/1.0.9] (release) (W2Ksp4)
[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.1.17pre) Gecko/20080715 SeaMonkey/1.1.12pre] (nightly) (W2Ksp4)

Error: uncaught exception: Permission denied to get property UnnamedClass.classes

[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9a5pre) Gecko/20070515 SeaMonkey/1.5a] (nightly) (W2Ksp4)

Error: uncaught exception: Permission denied to get property XPCComponents.classes

[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.0.2pre) Gecko/2008072102 SeaMonkey/2.0a1pre] (nightly) (W2Ksp4)

Error: Permission denied to get property XPCComponents.classes

[Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.9.1a2pre) Gecko/2008080519 SeaMonkey/2.0a1pre] (home, optim default) (W2Ksp4)

Error: Permission denied for <http://www.xulplanet.com> to get property XPCComponents.classes
Source File: chrome://global/content/bindings/dialog.xml
Line: 186

Comment 10

[Serge Gautherie (:sgautherie)]

(In reply to comment #8)
> you need to run with -chrome, or setup permission to ask for permission to use 
> xpconnect (and then ask)

Current status:
*"uncaught exception": fixed.
*"UnnamedClass": fixed.
*access denial for non-chrome/non-privileged code: expected.

R.WorksForMe.

Reopen, anyone, if you think there was something else to this bug.