437723 - [FIX]LookupPolicy does the wrong thing on jar: URIs

Status: RESOLVED FIXED

(Core :: Security, defect, P1)

Description

[Boris Zbarsky [:bzbarsky]]

This is a regression from bug 413161.  See bug 413161 comment 23 towards the end, and following comments.

The upshot is that saved privileges won't work right for unsigned jars, about: URIs (shouldn't be much of an issue) and view-source URIs (also probably not that bad, I think...).  They'll also not work right for any new nested URIs we or extensions might add.  This last is what worries me.

Comment 1

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

(In reply to comment #0)
> The upshot is that saved privileges won't work right for unsigned jars

Might this bear on bug 435254 as well?  That's Windows-only, though, AFAICT. :/

Comment 2

[Boris Zbarsky [:bzbarsky]]

It doesn't, and that bug is XP...  I marked it duplicate.

Comment 3

[Damon Sicore (:damons)]

Progress on this, Jonas?

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Just fix it

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 331396 [details] [diff] [review]
Just fix it

Thanks!

Comment 6

[Boris Zbarsky [:bzbarsky]]

Checked in.

Comment 7

[Aakash Desai [:aakashd]]

Changeset: http://hg.mozilla.org/mozilla-central/rev/27ebd6f0ae25