305656 - Deer Park - specifying JavaScript code in frame src attribute doesn't work

Status: VERIFIED DUPLICATE of bug 306630

(Core :: DOM: Core & HTML, defect)

Description

[Sohail Mirza]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050822 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b4) Gecko/20050822 Firefox/1.0+

The src attribute of a frame does not seem to accept JavaScript code or function
calls that output HTML.  This appears to be a regression from Firefox 1.0.6.

I have attached a simplified test case that illustrates the problem.  In Deer
Park, the top frame will remain blank, whereas Firefox 1.0.6 will render the
correct output.

Was this feature disabled to prevent XSS vulnerabilities?

Reproducible: Always

Steps to Reproduce:
1. View a framed HTML page where one of the frame's src attributes is JavaScript.
Actual Results:  
Frame with JavaScript src does not render.  Context menu on that frame has three
options:

Copy
Select All
--------------
View Selection Source

Expected Results:  
Output results of JavaScript into frame.

Comment 1

[Sohail Mirza]

Attachment: Simplified Testcase

The testcase could be further simplified by changing the frame's src attribute
value to "javascript:document.write("Hello, World!");".  The results are the
same in either case.

Comment 2

[Bob Clary [:bc] (inactive)]

not js engine, over to dom0

Comment 3

[Sohail Mirza]

(In reply to comment #2)
> not js engine, over to dom0

I really took a long hard look at which Component to file this bug under and JS
Engine was my best guess.  :)  Oh well, thank you for sending it to the correct
category!

Comment 4

[Asa Dotzler [:asa]]

Sohail, do you know when this regressed? Would you be willing to investigate
nightly builds to determine that?

Comment 5

[Sohail Mirza]

(In reply to comment #4)
> Sohail, do you know when this regressed? Would you be willing to investigate
> nightly builds to determine that?

Sure, I'll take a look into it tonight.

Comment 6

[Johnny Stenback (:jst)]

This is actually the exact same issue as I just reported (as a dupe) in bug
306630. Duping to that bug since there's already a fix there.

*** This bug has been marked as a duplicate of 306630 ***