266573 - event.isTrusted is false when you overlay contentAreaClick()

Status: RESOLVED INVALID

(Core :: Security, defect)

Description

[HJ]

First of all, bug 265176 is still marked as security sensitive so that's why
I've marked this one also as security sensitive, because it concerns
event.isTrusted, and I don't want to be blame for a possible early exposure of
that bug, or parts of it.

Now, MultiZilla overlays contentAreaClick.js and one of the functions that we
overlay is contentAreaClick(event) and I also need to check 

if(!event.isTrusted)
  return true;

but event.isTrusted is always false for middle-clicks in MultiZilla. I must be
doing something wrong or there is some sort of strange loophole. 

This works when I disable MultiZilla, so the code base for Mozilla seems to work.

I don't want to re-open and/or re-introduce fixed Mozilla bugs with MultiZilla
so that is why I am asking for your help.

Comment 1

[HJ]

Selecting security-general as component sets that flag, no?

Comment 2

[HJ]

Oh bummer, 'nglayout.debug.disable_xul_cache' was my problem. 
Marking INVALID
Sorry for the SPAM guys :(

Comment 3

[Jesse Ruderman]

Selecting "Security: General" does not automatically make a bug
security-sensitive.  You have to check the security-sensitive box when you file
the bug.

This bug should not be security-sensitive, IMO.

Comment 4

[HJ]

(In reply to comment #3)
> Selecting "Security: General" does not automatically make a bug
> security-sensitive.  You have to check the security-sensitive box when you file
> the bug.
> 
> This bug should not be security-sensitive, IMO.

Ok, thanks for the info. Another lesson learned ;)