227079 - Mozilla asks for security privileges where it shouldn't

Status: RESOLVED FIXED

(Core :: Security: CAPS, defect)

Description

[Frank Wein [:mcsmurf]]

First open URL with a current Mozilla trunk build, then mark some text and 
press "Cut". Mozilla asks for permissions because the script asks for it 
(UniversalXPConnect). Normally this shouldn't happen because this script isn't 
signed and signed.applets.codebase_principal_support is set to "false". Mozilla 
1.5 behaved correctly, so regression

Comment 1

[timeless]

fwiw Bug 202253 removed some extra privs from mozilla.org ... but that doesn't
seem related. I don't have a current mozilla with me as I'm traveling.

Comment 2

[timeless]

erm, i didn't mean to do that

Comment 3

[Brendan Eich [:brendan]]

Caillon, do you have time to look into this?

Marking blocking1.6b until we know more.

/be

Comment 4

[Frank Wein [:mcsmurf]]

I finally tracked down this bug *g* (what a work!) to the checkin frame between
2003-10-21-05 and 2003-10-22-05. Someone can go thorugh these checkins and see
what could be responsible for this?

Comment 5

[Christian :Biesinger (don't email me, ping me on IRC)]

http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=10%2F21%2F2003+05%3A00&maxdate=10%2F22%2F2003+05%3A00&cvsroot=%2Fcvsroot
is the bonsai link for the timeframe mcsmurf mentioned

Comment 6

[Christian :Biesinger (don't email me, ping me on IRC)]

note that one of those checkins is:
"Re-land patch for bug 83536, merging principal objects.
Also includes fixes from bug 216041.
r=bzbarsky
sr=jst"
(from caillon)

Comment 7

[Benjamin Smedberg]

nsCodebasePrincipal.cpp was removed entirely by caillon in his checkin for bug
83536. I don't understand the code enough to make sense of why ;)  IMO this is a
serious problem... the warning dialog is not nearly scary enough.

Comment 8

[Christopher Aillon (sabbatical, not receiving bugmail)]

Taking bug.

Comment 9

[Christopher Aillon (sabbatical, not receiving bugmail)]

Attachment: Fix

Hm, how did this silly mistake get by me and reviewers?  These checks somehow
fell out of my principal merge patch.  They go back in.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 136709 [details] [diff] [review]
Fix

How about "allow" instead of "truth"?  sr=bzbarsky with that.

Comment 11

[Johnny Stenback (:jst)]

Comment on attachment 136709 [details] [diff] [review]
Fix

What bz said. r=jst

Comment 12

[Christopher Aillon (sabbatical, not receiving bugmail)]

Fix checked in.