294406 - chrome XHTML documents do not get chrome privileges

Status: RESOLVED DUPLICATE of bug 221490

(Core :: DOM: Core & HTML, defect)

Description

[u81239]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050514 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050514 Firefox/1.0+

I made an XHTML document which loads another site in an iframe and then queries
the content of that iframe, such as:
document.getElementById('iframe').contentDocument.URL.

However, normally the script doesn’t have enough privileges to be able to do
that. An "Error: uncaught exception: Permission denied to get property
HTMLDocument.URL" error appears in the JavaScript console. So far so good, this
is expected.

So, I create a basic extension setup, and access the file through chrome://.
Problem: the error still appears!

When I rename the file to .html, everything works allright. The only conclusion
I can make here is that XHTML files loaded through the chrome don’t get the
additional privileges XUL and HTML files get.

Reproducible: Always

Steps to Reproduce:

Comment 1

[u81239]

Attachment: Testcase

Here’s a testcase. Please load from chrome://.

Comment 2

[Daniel Veditz [:dveditz]]

I don't get even your first prompt (which shouldn't require privs) to work when
this is .xhtml in chrome, nor does injecting "javascript:alert('foo');" do
anything. There may be something more fundamental here than a CAPS issue (caps
does not check extensions when assigning privileges).

Is there no "chrome" component? Neither DOM nor Layout seem the right component,
but they're the closest.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Caps doesn't check extensions, but chrome does.  See
http://lxr.mozilla.org/seamonkey/source/rdf/chrome/src/nsChromeProtocolHandler.cpp#713
-- it only gives the system principal to chrome:// channels which are pointing
to .xml, .xul, and .html files.

This is a long-standing issue; I'm sure we have other bugs on it.

Comment 4

[Boris Zbarsky [:bzbarsky]]

*** This bug has been marked as a duplicate of 221490 ***