445725 - [FIX]file:// iframes get the wrong principal after a reload

Status: RESOLVED FIXED

(Core :: DOM: Navigation, defect)

Description

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: testcase

I lost track of when this happened, but it appears that currently, an iframe in an HTML page loaded from a file:// URI inherits the principal of the outer page. However, when the subframe has been navigated and the page is reloaded (e.g. via the reload button), the subframe's principal changes to not inherit, meaning that the page is no longer allowed to access the subframe.

In the testcase provided by Aaron Morgulis, the subframe is one directory level deeper than the outer page.

I'm filing this as unconfirmed because I'm not sure my initial premise (about file:// iframes inheriting their owner's principal) is correct.

Comment 1

[Boris Zbarsky [:bzbarsky]]

So there is code in nsDocShell::DoChannelLoad that should be setting the owner on the channel, and we should be passing in the "right" owner from the history entry here, I would think.  Want to look into why that's failing?

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

There is no owner on the channel because we navigated via a click on an anchor link. This calls:
            OnNewURI(aURI, nsnull, mLoadType, PR_TRUE);
which passes a null channel (therefore, no owner). From IRC:

06:37 <@bz> That sounds like a bug
06:37 <@bz> I guess it didn't bite us before because for javascript: and data: we don't do anchor loads

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Makes sure to copy over the owner on anchor scroll.

Comment 4

[Johnny Stenback (:jst)]

Comment on attachment 351651 [details] [diff] [review]
Fix

Looks good.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 351651 [details] [diff] [review]
Fix

I think it's worth taking this in 1.9.1

Comment 6

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/mozilla-central/rev/633b48e70c60

Need file:// mochitests to test this.

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 351651 [details] [diff] [review]
Fix

a191=beltzner

Comment 8

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/releases/mozilla-1.9.1/rev/83c1df2b2e11