304284 - doc.location.href is URL of document currently loaded in doc's tab

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

If you hold a reference to |document| and get its location.href after the user
has navigated to another page, you can see the URL of the new page.  

In July 29 builds and earlier, this resulted in a "permission denied" exception.
 I think it should give the URL of the old document, but throwing an exception
is better than giving another URL.

This could be a regression from split windows:

Firefox 1.0.6   -  not vulnerable
Trunk, July 10  -  not vulnerable
Trunk, July 29  -  not vulnerable
Trunk, July 31  -  broken: no error in JS console, crashed once (TB8275556H)
Trunk, Aug 2    -  vulnerable
Trunk, Aug 10   -  vulnerable

Comment 1

[Jesse Ruderman]

Attachment: demo: tracks URLs loaded in the original tab/window

Comment 2

[Brendan Eich [:brendan]]

jst, can you take this?  If not, brain-dump here and mrbkap or I will.

/be

Comment 3

[Johnny Stenback (:jst)]

Ok. I've got a fix for this in my tree. The fix is to make the inner window hold
the location object and to null out the docshell in it when the inner is torn
down (i.e. when we load a different page). This brings us back to throwing an
exception (though not a security exception) when the location object is used off
of a document that's no longer loaded. Once I have access to a tree clean enough
to create a diff from I'll attach a diff...

Comment 4

[Johnny Stenback (:jst)]

Attachment: Make location be per inner window (and invalidate it when the inner window is no longer the current inner window).

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 192493 [details] [diff] [review]
Make location be per inner window (and invalidate it when the inner window is no longer the current inner window).

r=me

Comment 6

[Brendan Eich [:brendan]]

Comment on attachment 192493 [details] [diff] [review]
Make location be per inner window (and invalidate it when the inner window is no longer the current inner window).

sr=me

Minor thought for later: maybe we should union stuff in nsGlobalWindow.h to
save space at some point.

/be

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

This was fixed by the checkin for bug 303267.

Comment 8

[Daniel Veditz [:dveditz]]

Regression due to split windows, not a problem in aviary/1.7 branches

Comment 9

[Bob Clary [:bc] (inactive)]

Mozilla 1.7.13/20060213 winxp on attachment 192352 [details] _will_ track the first url loaded.

Comment 10

[Bob Clary [:bc] (inactive)]

(In reply to comment #9)
> Mozilla 1.7.13/20060213 winxp on attachment 192352 [details] [edit] _will_ track the first url
> loaded.
> 

Mozilla 1.7.13/20060217 winxp on attachment 192352 [details] _will not_ track the first url
loaded.