431935 - Can't use window.postMessage(..., "file://") to send messages to file: URLs

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Jeff Walden [:Waldo]]

You can't send a message to a page at a file: URL without using "*" as the target origin, because "file://" doesn't provide enough information for the contains test we do for a security check.  The spec gives us leeway to make this be a file system path, but that doesn't seem optimal as it means sending a message to a webpage exposes a local file system path.  Not sure what's best here, but the current setup isn't satisfactory...

Comment 2

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.