303332 - Feedview relies on non-chrome JavaScript (Feedview is broken when javascript is disabled)

Status: RESOLVED INVALID

(Firefox :: Bookmarks & History, defect)

Description

[Matt]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050803 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050803 Firefox/1.0+

Feedview cannot work on any feeds unless that site is somehow whitelisted to
allow JavaScript.  NoScript allows you to white-list, but Feedview still
requires JS enabled on any site that has an RSS feed that can be viewed with
Feedview.  Basically, we should be able to use Feedview without worrying about a
website's security options for JavaScript.

Reproducible: Always

Steps to Reproduce:
1. Disable JavaScript
2. View a feed with Feedview

Actual Results:  
You can only see the headers to the news stories, the sliding bar does nothing,
and clicking the headers simply takes you back to where the feed points to for
that entry.

Expected Results:  
Feedview should work on any site regardless of JavaScript options.  I'd suggest
some sort of chrome:// usage similar to how Sage views scripts.  The URL can
still be shown in the toolbar as the link to the feed, but the actual Feedview
JS should be contained within the chrome:// URIs.  If it already does this, then
there might be some compatibility issues going on with NoScript and Firefox in
which JavaScript functionality that would normally seem dependent on the browser
itself (e.g. bookmarklets) does not work when disabling JavaScript for normal
websites.

Comment 1

[Asaf Romano (gone)]

Well, doing that would also allow us to implement stuff like inline add live
bookmark link, etc. However, that would open a can of worms, security wise.

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

This can be fixed by making the scripts live in XBL bindings where the binding
has a chrome url.

Comment 3

[Mike Beltzner [:beltzner, not reading bugmail]]

If this gets us one step closer to having a "Add this feed as a Live Bookmark
..." button underneath the sliding bar, then I'd say let's go for it. Assuming
Mano's security concerns are answered by packaging the JS in XBL bindings.

Comment 4

[Myk Melez [:myk] [@mykmelez]]

> This can be fixed by making the scripts live in XBL bindings where the binding
> has a chrome url.

This is the right approach, but it's not possible at the moment, because chrome
XBL bound to content currently has no XPConnect privileges, and feedview needs
XPConnect privileges to read preferences and access stringbundles.


> If this gets us one step closer to having a "Add this feed as a Live Bookmark
> ..." button underneath the sliding bar, then I'd say let's go for it.

It does, but only in conjunction with a security model for chrome bound to
content that lets feedview chrome access the live bookmark adding functionality.

Comment 5

[Phil Ringnalda (:philor)]

Feedview is dead; long live Feed Preview.