376484 - [FIX]Testcase from bug 33961 has regressed - javascript: pseudo url in stylesheet doesn't work

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Martijn Wargers (dead)]

See url, which is the Partial testcase from bug 33961, the text should be green  but isn't anymore in current trunk builds.
This regressed between 2007-02-15 and 2007-02-17, I think a regression from bug 369244.

Comment 1

[Boris Zbarsky [:bzbarsky]]

This is actually purposeful, for the time being.  In the new world, we're white-listing the set of places where JS is allowed to execute, for now.  Once we resolve bug 221428 we can sort out exactly what the desired behavior here is.

Sadly, I have to remove the "blocks" dep to be able to set the "depends" dep...

We could also switch to defaulting to "execute in sandbox" instead of defaulting to "do not execute".  That would restore the state of things as of bug 33961.

Brendan, jst, sicking, what do you think?

Comment 2

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I think "execute in a sandbox" is the way to go as long as we still execute them async and we're reasonably sure our sandboxes are good.

Comment 3

[Boris Zbarsky [:bzbarsky]]

> and we're reasonably sure our sandboxes are good.

They're not great.  See bug 372075.  But we'll fix that.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

I don't _quite_ want to change the comments to say that the default must be EXECUTE_IN_SANDBOX for all script channels... but I could be convinced.  jst, what do you think?

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 260771 [details] [diff] [review]
Fix

Fine with me. I don't feel strongly about the wording in the comment about the default.

r+sr=jst

Comment 6

[Boris Zbarsky [:bzbarsky]]

Checked in, with the tests.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Though..  I guess those tests only pass if you also have the patch for bug 221428  applied, since otherwise we have no owner principal on the channel and hence the script does not run.

I guess we should reopen pending that.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Fixed, and tests marked as passing.