341313 - [FIX]CanExecuteScripts hard codes about:neterror as the only page that can execute script when scripts are disabled

Status: RESOLVED FIXED

(Core :: Security: CAPS, defect, P2)

Description

[Ben Goodger (use ben at mozilla dot org for email)]

In nsScriptSecurityManager::CanExecuteScripts, about:neterror is hardcoded as the only local page that can execute scripts even when js is disabled. This list should instead be extendable, so that I can add about:feeds to it from the browser code without having to edit code in nsSSM.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed fix

I limited this to about: URIs for the time being.  If we want to have a protocol handler flag for this, we could do that, and add a third about: protocol handler for URIs which drop privs but want to allow script execution or something like that.  But I'm not sure we want to allow random other protocols to force script execution...

Comment 2

[Darin Fisher]

Comment on attachment 226425 [details] [diff] [review]
Proposed fix

nit: When you called the method getURIFlags, I thought you intended to prefix all flags with URI_.  If you meant "get flags for this URI", then the method should probably have been called getFlagsForURI ;-)

r=darin

Comment 3

[Boris Zbarsky [:bzbarsky]]

I definitely meant the latter.  Do you want me to go ahead and rename the method?

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 226425 [details] [diff] [review]
Proposed fix

sr=jst

Comment 5

[Darin Fisher]

> I definitely meant the latter.  Do you want me to go 
> ahead and rename the method?

Up to you.  It is probably not worth the time ;-)

Comment 6

[Boris Zbarsky [:bzbarsky]]

Fixed.  I didn't change the name.

Comment 7

[Christian :Biesinger (don't email me, ping me on IRC)]

Comment on attachment 226425 [details] [diff] [review]
Proposed fix

-    { "neterror", "chrome://global/content/netError.xhtml", PR_TRUE }
+    { "neterror", "chrome://global/content/netError.xhtml", PR_TRUE, PR_TRUE }

have you considered making the third field a "flags" field instead, so that the values are more self-documenting and that not all lines have to be changed for a new flag?

Comment 8

[Boris Zbarsky [:bzbarsky]]

Hmm...  I suppose I could do that, yeah... file a bug and I'll deal in July?

Comment 9

[Christian :Biesinger (don't email me, ping me on IRC)]

filed Bug 342914