321860 - user_pref("capability.policy.default.HTMLDocument.onmousedown", "noAccess") does not work

Status: RESOLVED WONTFIX

(Core :: Security: CAPS, defect)

Description

[Stefan A. Möller]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8) Gecko/20051219 SeaMonkey/1.0b
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8) Gecko/20051219 SeaMonkey/1.0b

Setting
  user_pref("capability.policy.default.HTMLDocument.onmousedown", "noAccess");
does not prevent
  document.onmousedown = somefunction();
to be executed.

I expected it to work as well as
  user_pref("capability.policy.default.Window.onmousedown", "noAccess");
does prevent
  window.onmousedown = somefunction();


Reproducible: Always

Steps to Reproduce:
1. Set
user_pref("capability.policy.default.HTMLDocument.onmousedown", "noAccess"); and
user_pref("capability.policy.default.Window.onmousedown", "noAccess");

2. Open the attached test case and right click onto the content area.
Actual Results:  
Alert box opens. Context menu is suppressed.

Expected Results:  
No Alert, but context menu instead.

Comment 1

[Stefan A. Möller]

Attachment: testcase

Comment 2

[Andrew Schultz]

==> caps

Comment 4

[Boris Zbarsky [:bzbarsky]]

This isn't a property managed by xpconnect, so not surprising.  But in general, the capability.policy stuff is going away, so we don't plan to fix this.