Open Bug 302846 Opened 19 years ago Updated 2 years ago

nsSecurityManager::GetBaseURIScheme should assume "about safe"

Categories

(Core :: Security: CAPS, defect)

Product:
Core
Component:
Security: CAPS
Type:
defect

Tracking

()

People

(Reporter: dveditz, Assigned: dveditz)

Details

nsSecurityManager::GetBaseURIScheme has a list of about: pages that get turned
into "about safe" for checkLoadURI comparisons. It would be a shorter list of
strcmps, and a safer default when new about schemes are added, if we assumed
"safe" and required the privileged ones to be explicitly listed.
Aren't the "safe" ones allowed to be linked to from untrusted content?
QA Contact: caps
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.