227842 - "Permission denied to get property HTMLDocument.getSelection" in Leo Bookmarklet on some webpages

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[Peter Weilbacher]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.1) Gecko/20031008
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6a) Gecko/20031029

I am using a bookmarklet to access the German<->English dictionary at
dict.leo.org. The JS code is the following:

javascript:
   s=document.getSelection();
   for (i=0;i<frames.length;i++) {
       s=frames[i].document.getSelection();
       if(s)break;
   }
   if (!s) 
      void(s=prompt('Enter word(s) for LEO.',''));
   if(s) {
      leow=open('http://dict.leo.org/?client=bookmarklet&search='+escape(s),
                'LEODict','width=775,height=600,scrollbars=yes,resizable=yes');
      leow.focus();
   }

In the bookmark properties this is of course folded into one line without spaces...

This bookmark works on many pages (e.g. http://www.mozilla.org). I mark one
word, click the bookmarklet in my personal toolbar, and the LEO-Dict will open
in a new window and show me the translation(s) for this word.

On some pages it does not work, one such page is the above URL and any other
TheReg page. When searching for a reason why, I opened the JS Console, and saw
the error message
   Error: uncaught exception: Permission denied to get property
HTMLDocument.getSelection

I don't find a reason why that page does not allow it (neither did the people in
de.comp.os.os2.browser), so I guess it's a Mozilla bug.

I could reproduce it in both 
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.1) Gecko/20031008
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6a) Gecko/20031029

But under OS/2 both 1.4.1 and a 1.6b nightly it does work correctly.

Reproducible: Always

Steps to Reproduce:
1. Create a bookmarklet with the above code
2. Go to the given URL
3a. Click the bookmarklet
  or
3b. Mark a word and click the bookmarklet
Actual Results:  
Nothing happens (apart from error in JS Console)

Expected Results:  
Open a window with LEO Dict's results.

Hope I got the right component...

Comment 1

[Boris Zbarsky [:bzbarsky]]

> s=frames[i].document.getSelection();

What if frames[i] is loaded from a different site (which is the case here)? 
Then allowing this would allow reading other sites, which would be a security
violation.  Hence the error you see.

The bookmarklet needs to be fixed to handle security exceptions on that call.