317487 - Firefox 1.5 enumerates GeckoActiveXObject

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Daniel Veditz [:dveditz]]

As of bug 308856 enumerating the window object finds the GeckoActiveXObject constructor, whereas in 1.0 it did not. The function existed in 1.0, however, and it's not any more functional now in 1.5, just more visible.

Since we don't actually support any ActiveX controls by default we probably would be happier if it were non-enumerable, but I don't think it's actually hurting anything.

Comment 1

[Martijn (MozBrowser.nl)]

(In reply to comment #0)
> Since we don't actually support any ActiveX controls by default we probably
> would be happier if it were non-enumerable, but I don't think it's actually
> hurting anything.

It could hurt scripts that try to detect for ActiveX-support.
http://www.gigidagostino.com/flashsite/default.asp?h=1024&w=1280 for example uses this code: if (navigator.appName == "Netscape" && !window.GeckoActiveXObject)
If both checks are true it will show an alternative Java-applet for playing music.
But now the site does not load the ActiveX-object and it also does not load the Java-applet because the second check is false.

I guess that this code is based upon the instructions in http://devedge-temp.mozilla.org/viewsource/2003/windows-media-in-netscape/index_en.html
Should this devedge-article be updated or should this function work in another way ? Now it tells the script that the browser does support ActiveX (???), but only Netscape 7.1 seems to come with an ActiveX-plugin by default (and Netscape 8 perhaps because it can also switch to the IE-engine) ?

Comment 2

[Tim Powell]

This is definitely showing up, so confirming. There is current documentation that is incorrect since Firefox 1.5+ does not support activeX. 
http://developer.mozilla.org/en/docs/Windows_Media_in_Netscape

As noted in comment #1, this makes it problematic to try and detect which browsers can script windows media player.

Comment 3

[Nochum Sossonko [:Natch]]

This is turning out to be a problem (afaict) with quite a few websites, although only with 3.* and not with 2.*, is that possible? See bug 470743.

Comment 4

[Mike Beltzner [:beltzner, not reading bugmail]]

Blizzard: should we be evangelizing that we don't support this anymore?

Comment 5

[Ed Morley [:emorley]]

The ActiveX embedding API was removed in bug 662023 and friends.

-> INVALID

[Filter bugspam on activexinvalid]