432919 - Help viewer content pane should not allow scripts, plugins, meta redirects, or subframes

Status: RESOLVED FIXED

(SeaMonkey :: Help Viewer, defect)

Description

[Daniel Veditz [:dveditz]]

We should turn off AllowJavaScript and AllowPlugins in the help content viewer docshell as we've done for various other remote content <browsers> in chrome. Do we need scripting in help? We certainly don't in Firefox 2 with local content, so if you refuse this for FF3 at least make it a branch-only bug rather than close it out. See bug 432406 for why we'd want this. In FF3 loading remote content raising different but similar hijacking concerns.

Comment 1

[Reed Loden [:reed]]

Attachment: patch - v1

Something like this?

Comment 2

[Jeff Walden [:Waldo]]

Comment on attachment 320091 [details] [diff] [review]
patch - v1

rs=me on the assumption that actually works, I don't remember the precise syntax for doing this...

Comment 3

[Jeff Walden [:Waldo]]

Note that anyone rolling their own content packs might have a fit here; dunno if any of them use script or not.  Also please double-check browser help doesn't; I think we use target="..." instead of javascript: URLs, and I think that's the only case where we might have used script.

Comment 4

[Reed Loden [:reed]]

Comment on attachment 320091 [details] [diff] [review]
patch - v1

dveditz, can you double check since this is going on branch?

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 320091 [details] [diff] [review]
patch - v1

This works great, but would you mind disabling allowSubframes and allowMetaRedirects too?

I'll sr that if it's OK with jwalden.

Comment 6

[Daniel Veditz [:dveditz]]

Attachment: turn off a couple more things

Comment 7

[Jeff Walden [:Waldo]]

Comment on attachment 320112 [details] [diff] [review]
turn off a couple more things

I like commoning expressions, but this is basically dead code anyway, so whatever.  :-)

Comment 8

[Samuel Sidler (old account; do not CC)]

Comment on attachment 320112 [details] [diff] [review]
turn off a couple more things

Approved for 1.8.1.15. a=ss for release-drivers.

Comment 9

[Reed Loden [:reed]]

Checking in toolkit/components/help/content/help.js;
/cvsroot/mozilla/toolkit/components/help/content/help.js,v  <--  help.js
new revision: 1.49; previous revision: 1.48
done

I'll get this on branch in a little bit.

Comment 10

[Reed Loden [:reed]]

MOZILLA_1_8_BRANCH:

Checking in toolkit/components/help/content/help.js;
/cvsroot/mozilla/toolkit/components/help/content/help.js,v  <--  help.js
new revision: 1.37.2.6; previous revision: 1.37.2.5
done

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Is there any way to load scripts, plugins, redirects, etc into the Help Viewer in order to verify this fix?