291656 - there is no way to insert the protocol "javascript:" in Configurable Security Policies

Status: RESOLVED WORKSFORME

(Core :: Security: CAPS, defect)

Description

[intendentedelleacque]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; it-IT; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

I've searched in the documentation, but it seems that there is no way to insert
the protocol "javascript:" in Configurable Security Policies.
This is a problem because, for example, if I deny access to javascript to all
sites except one that has <a href="javascript:function">, this pseudo-link will
not work and so it will be useless to insert it like exception.
I make an example, because my english is bad:
I set a policy like this one

user_pref("capability.policy.policynames", "jsok");
user_pref("capability.policy.default.javascript.enabled", "noAccess");
user_pref("capability.policy.jsok.sites", "http://goodsite.com");
user_pref("capability.policy.jsok.javascript.enabled", "allAccess");

If http://goodsite.com has links <a href='javascript:alert("yes");'>, the alert
will not be displayed and so the capability policies become useless.


Reproducible: Always

Steps to Reproduce:
1. Set a capability policy like this:
user_pref("capability.policy.policynames", "jsok");
user_pref("capability.policy.default.javascript.enabled", "noAccess");
user_pref("capability.policy.jsok.sites", "http://goodsite.com");
user_pref("capability.policy.jsok.javascript.enabled", "allAccess");
2. Write in the url bar javascript:alert("yes");  or try to click in
http://goodsite.com a link that has code <a href='javascript:alert("yes")'>
3. 
Actual Results:  
The alert will not be displayed in both cases, because the
user_pref("capability.policy.default.javascript.enabled", "noAccess");
prevents the use of "javascript:" protocol and there is no way to insert this
protocol in user_pref("capability.policy.jsok.sites")

Expected Results:  
There should be a way to insert the "javascript:" protocol in Configurable
Security Policies

Comment 1

[Boris Zbarsky [:bzbarsky]]

Sicking, what's the bug# for that "keep principals with the URI" bug?  This
should depend on it...

Comment 2

[Giorgio Maone [:ma1]]

WFM, likely a side effect of the 1.0.3->1.0.4 security fixes.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Yeah, this is worksforme.