305269 - When Firefox is not already running, it accepts chrome:// URLs without -chrome

Status: RESOLVED FIXED

(Firefox :: Security, defect)

Description

[Jesse Ruderman]

Bug 298255 was supposed to stop external applications from inadvertently feeding
chrome:// URLs (among others) to Firefox.  This seems to be fixed for the case
when Firefox is already running but not for the case where it is not already
running.

Steps to reproduce: Start+R,
"C:\moz\firefox 0818 branch\firefox.exe" "chrome://browser/content/browser.xul"
* Does nothing if Firefox is already loaded.
* If Firefox is not already loaded, incorrectly loads browser.xul into the
content area.

Comment 1

[Mike Connor [:mconnor]]

http://lxr.mozilla.org/mozilla/source/browser/base/content/browser.js#580 should
be makeURI, not makeURL, on trunk/1.5 branch.

Comment 2

[Jesse Ruderman]

mconnor's fix works, but it breaks shift+clicking bookmarks with chrome:// URLs.
 I'll file a new bug for that after fixing this one.

Comment 3

[Jesse Ruderman]

Fixed trunk and Gecko 1.8 branch.

Comment 4

[Jesse Ruderman]

Filed bug 305372 for the bookmark issue.

Comment 5

[Jesse Ruderman]

Attachment: patch (already checked in)

Comment 6

[Jesse Ruderman]

Attachment: patch (already checked in)

Oops, previous attachment was a backwards diff.