339713 - Allow more protocols for search plugin actions

Status: RESOLVED DUPLICATE of bug 295018

(Firefox :: Search, enhancement)

Description

[Richard Gibson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3

HTTP and HTTPS are [hard-coded](http://lxr.mozilla.org/mozilla/source/xpfe/components/search/src/nsInternetSearchService.cpp#2614) as the only available protocols for handling searches.  Allowing data: and file: protocols will open up new possibilities such as side-by-side searches of multiple sites, prompting for secondary variables (e.g., driving directions), and automatic parsing (of dates for instance, or names in both "Last, First" and "First Last" forms).  Even more can be done with chrome:, like searching the local computer/network or bookmarks/browsing history/downloads/feeds/tabs/etc., configuring secondary variables on the fly (driving directions start/end, results per page), locally saved persistent results, and other applications that I can't yet imagine.

Security shouldn't be an issue, because data: and file: in this use are merely frontends for HTTP, and any abuse from a chrome: search could just as easily come from a non-search extension.  I think the change would be valuable; can anyone give a reason why it should not be implemented?

Reproducible: Always

Comment 1

[:Gavin Sharp [email: [e-mail]]]

There are no such restrictions in the new Search service (http://lxr.mozilla.org/seamonkey/source/browser/components/search/nsSearchService.js), which will ship with Firefox 2 and is currently used on both the trunk and the 1.8 branch.

This needs to be audited for security issues.

Comment 2

[Tracy Walker [:tracy]]

reporter. have you tried 2.0b1?  does it address this issue for you?

Comment 3

[:Gavin Sharp [email: [e-mail]]]

*** This bug has been marked as a duplicate of 295018 ***