32343 - Components object appears to be accessible via javascript: urls entered in url bar

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Bill Law]

I entered this in the url bar:

javascript:alert(Components)

and an alert box opened with content "[xpconnect wrapped nsIXPCComponent]".

I think this might be some kind of security exposure.  I'm envisioning a web 
page with this JS for a link and words to the effect: right-click on this link, 
choose "copy link location", and then paste into your url bar.  If that code can 
access any xpconnect component, bad things might ensue.

In the course of playing with this, I also discovered that sometimes javascript: 
urls in the url bar were apparently evaluated in context of *other* windows.  I 
saw this sort of message on the console:

JavaScript Error: access disallowed from scripts at mailto:[e-mail]?cc=j
[e-mail] to documents at another domain

If you visit this page with another browser and don't see a similar error, it ma
y indicate that the site has not yet been updated to support standards implement
ed by the Mozilla browser such as the W3C Document Object Model (DOM).  Please s
ee http://developer.netscape.com/mozilla/ for more information.  This may be 
related?

Comment 1

[Norris Boyd]

Fixed:
Checking in dom/src/jsurl/nsJSProtocolHandler.cpp;
/m/pub/mozilla/dom/src/jsurl/nsJSProtocolHandler.cpp,v <-- nsJSProtocolHandler
.cpp
new revision: 1.39; previous revision: 1.38
done

Comment 2

[John Unruh]

Verified fixed.