230825 - no javascript function to reload easily RDF datasource with unsigned application

Status: RESOLVED DUPLICATE of bug 235866

(Core Graveyard :: RDF, enhancement)

Description

[Laurent Jouanneau]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031021
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5) Gecko/20031021

In XUL, we can populate a tree or a listbox for example, from an RDF datasource.
There is an attribute, datasource, to specifie the datasource.

For distant and unsigned xul file, xul component can be populated : the RDF file
is loaded when the xul file is loaded. 
But there isn't function or method of object to reload only the RDF file. We can
reload RDF file only if the xul file is signed (an example here :
http://www.maubi.net/~waterson/mozilla/examples/refresh.html )

I think that there isn't security problem if we can have an function like that :
document.getElementById("vbox").database.reloadDatasource(); to reload
datasource without needed privileges, without needed to load an instance of a
XPCOM object etc...

This functionnality may be very usefull to do Web Application.

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[Chase Tingley]

Axel, would this be covered by the stuff in bug 122846?

Comment 2

[Axel Hecht]

yes, though not directly. This is because Refresh is not a method of 
nsIRDFCompositeDataSource, but of nsIRDFRemoteDataSource.
Of course, we could add a 
refreshDataSources(in boolean blocking)
to nsIRDFCompositeDataSource, but I'm not sure if there is really a sufficient
demand to justify an additional method on that interface.

Comment 3

[Vincent Robert]

> I'm not sure if there is really a sufficient
> demand to justify an additional method on that interface.

When you want to make an HTML-based application, you have to care about HTML
reload, in order to provide you another hit to attack your database. But it
makes you reload your whole interface instead of juste reloading data.

In XHTML, you could do XML data and XSLT interface, so you would be able to
reload data only and the XSLT stylesheet should be in cache.

But XUL is powerful because it greatly separates data and interface, but if you
can't reload data without reloading interface, you lose every advantage of this
separation.

Comment 4

[Axel Hecht]

(In reply to comment #3)
> > I'm not sure if there is really a sufficient
> > demand to justify an additional method on that interface.
> 
<...>
> But XUL is powerful because it greatly separates data and interface, but if you
> can't reload data without reloading interface, you lose every advantage of this
> separation.

I was talking just about the addition of that method to 
nsIRDFCompositeDataSource, not about exposing reload of remote datasources.
That feature exists already, it's just that remote content can't get to it.
Bad hair day, as fixing that requires to revive a security review, which got
stuck at all kind of places.

Comment 5

[Vincent Robert]

(In reply to comment #4)
> That feature exists already, it's just that remote content can't get to it.
> Bad hair day, as fixing that requires to revive a security review, which got
> stuck at all kind of places.

:-)

But no matter how hard it is to deal with this topic, this issue is really
important in order to develop Mozilla-based online applications.

It's just for the good of Mozilla ;-)

Comment 6

[Nigel McFarlane]

Logged bug 232710 to track the general problem.

Comment 7

[Benjamin Smedberg]

Found this after I filed my new bug, but my bug has a patch :)

*** This bug has been marked as a duplicate of 235866 ***