42076 - Non-chrome URLs not able to load chrome URLs

Status: VERIFIED FIXED

(Core :: Networking, defect, P3)

Description

[David Hyatt]

Something has changed so that a local file e.g., a local XUL file cannot load a 
chrome URL skin.  There is no security problem here.  This is another bad 
regression that needs to be fixed.

Comment 1

[David Hyatt]

Nominating for dogfood.

Comment 2

[leger]

Putting on [dogfood+] radar.

Comment 3

[Andreas Otte]

I guess this must be because of the changes mstoltz did to
nsScriptSecurityManager.cpp (line 570) on 06-01-2000 (Version 1.73). There was a
new url class introduced (LocalProtocol) which can only by called by urls of the
same class. Currently only resource and chrome are in that class. cc-ing
mstoltz.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

David,
  Could you tel me more specifically what behavior is required? When you say 
'local XUL file,' is it a file loaded from a file:// URL? Do file:// URLs need to 
be able to access chrome:// URLs? Our security policy for which URLs can load 
which URLs is set out in nsScriptSecurityManager::CheckLoadURI. Could you please 
take a look at this function and tell me what changes should be made to the 
policy?

Comment 5

[Gagan]

hyatt: is this a dup of bug 42073?

Comment 6

[David Hyatt]

believe this was security-related.

Comment 7

[David Hyatt]

Chrome URLS should be loadable by anyone.  An HTTP or FILE URL should be able 
to load a chrome skin file or use chrome overlays.

Comment 8

[Mitchell Stoltz (not reading bugmail)]

*** Bug 42073 has been marked as a duplicate of this bug. ***

Comment 9

[Mitchell Stoltz (not reading bugmail)]

Attachment: Patch for TEMPORARY fix. Please Review.

Comment 10

[David Hyatt]

evaughan is going to look at your patch, mitch, and let you know if it works.

Comment 11

[Eric Vaughan]

Yep this patch works. Looks good.

Comment 12

[Ben Goodger (use ben at mozilla dot org for email)]

*** Bug 42481 has been marked as a duplicate of this bug. ***

Comment 13

[Mitchell Stoltz (not reading bugmail)]

*** Bug 42482 has been marked as a duplicate of this bug. ***

Comment 14

[Mitchell Stoltz (not reading bugmail)]

Fix checked in.

Comment 15

[Tom Everingham]

verified:
Win98 2000070508