340092 - Security error accessing cssRules via DOM after setting document.domain

Status: RESOLVED INVALID

(Core :: DOM: CSS Object Model, defect)

Description

[steve heron]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4

This is new in 1.5.04 
The following, which has worked in every version of FF to date...
	var styleSheet = GL_GetStyleSheet("column_widths");
	var rules = styleSheet.cssRules;
now causes this...
[Exception... "Access to restricted URI denied" code: "1012" nsresult: "0x805303f4 (NS_ERROR_DOM_BAD_URI)" location: "http://steve.caplin.com/SL4B/webcentric_caplin/script/view/html_grid.js Line: 119"]

Reproducible: Always

Steps to Reproduce:
1. get a reference to a stylesheet object 
2. try to access the cssRules collection
3. (may be signigficant, document.domain has been set)




this is a critical bug for my application FW, which depends on this behaviour.

Comment 1

[steve heron]

correction to this report: I just rolled back to 1.5.03 and still see the bug. I think the cause is that I wasn't previously setting document.domain and then it worked. For further info, I'm accessing an inline stylesheet (style block) declared in the html page from which the script has been loaded. The domain is set to the same domain from which the page was loaded. For all I know, this bug has always been here. Reminds me of the bug whereby I cannot access responseXML.documentElement on XMLHTTPRequest object after document.domain has been set (even though I can still accesss responseText ! I'm sure this one has been reported separately).
My app no longer supports firefox until this one gets foxed (IE and Safari only)

Comment 2

[Steve England [:stevee]]

Reporter, do you still see this problem with the latest Firefox 2? If not, can you please close this bug as WORKSFORME. Thanks!

Comment 3

[Sten Duncan]

I have just encountered this problem:

Firefox 2.0.0.6

I have an html page that includes stylesheets as

<link title="t1" id="t1" rel=stylesheet type="text/css" href="/css/t1.css">

I can access the DOM document.styleSheets[myidx].cssRules (etc) fine.

UNTIL, I put document.domain = "mydomain.com" (with the correct domain of course) on my pages. As soon as I do that, the moment I try to reference the "cssRules" property of the sheet object, I get the access denied error given above.

This is a very bad problem for me.

Comment 4

[Harry]

I am having the same problem too, after I put document.domain = "mydomain.com"; in the javascript, all the CCS and everything **** out. No problems with IE, is someone going to fix this?

Comment 5

[Harry]

Can we pay someone to have this fixed? It is pretty serious...

Comment 6

[Johan Sundström]

Still present in Firefox 2.0.0.10.

Harry: you could always put up a job at rentacoder.com or similar, producing a patch that fixes the problem (likely that the styleSheets[n] object does not also get its domain changed with the document, or that the security test fails to take document.domain into consideration). With a bit of luck, posting the fix here gets it into upstream Firefox builds.

Comment 7

[Johan Sundström]

OS is probably "ALL"; I confirmed it on the MacOS X build.

Comment 8

[Mats Palmgren (inactive)]

Can someone confirm this bug still occurs in Firefox 3 please?

Comment 9

[Mats Palmgren (inactive)]

Attachment: Testcase?

Comment 10

[Mats Palmgren (inactive)]

Attachment: Testcase?

Comment 11

[Mats Palmgren (inactive)]

-> CSSOM for further triage

Comment 12

[Boris Zbarsky [:bzbarsky]]

This is more or less done on purpose, since not doing this would allow stealing data from stylesheets that didn't opt in by setting document.domain.

I'm pretty sure HTML5 will require this behavior.