bug 240552 comment 59 raised the possibility of an attacker opening a whitelisted site in a frame and poking its DOM to launch an install. That shouldn't be possible due to the same-origin policy, but just about anybody could add an install-launching bugzilla attachment fairly anonymously and then load that in a frame/window.
Not blocking 1.7--we're going to turn off the whitelisting for the release until we get some UI for it and we don't want bugzilla testcase attachments to mysteriously fail in the meanwhile.
Instead of having mozilla.org on the whitelist and the subdomain bugzilla.mozilla.org on the blacklist, how about having update.mozilla.org on the whitelist?
That's definitely what Ben's going to do for Firefox. I thought that was too restrictive, but maybe we'd only need updates.mozilla.org and ftp.mozilla.org for the suite. There are probably some test cases on www.mozilla.org, but testers could easily add that one themselves.
We don't need to fix this one as long as we don't whitelist mozilla.org. Currently the plan is to whitelist only update.mozilla.org