451037 - document.loadBindingDocument() returns a document that does not have a script handling object

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

This is similar to bug 448548.

This is fx2-only.  On fx2, document.loadBindingDocument() returns a document
that does not have a script handling object.  (On trunk and fx3.0.x, it does
not return anything.)

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

I guess this is for me

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

There are possibly ways to get this to work in FF3 as well. It's harder to get a reference to the binding document, but it might still be possible. I don't think we intentionally try to prevent it.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: simplest possible hack

This is ugly, but the whole method is.
Fortunately the API has changed on 1.9.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Perhaps for non-chrome (non-cached) xbl documents, the scripthandlingobject could be the same as what the bound document has.

Comment 6

[Olli Pettay [:smaug][[e-mail]]]

(In reply to comment #3)
> There are possibly ways to get this to work in FF3 as well. It's harder to get
> a reference to the binding document, but it might still be possible. I don't
> think we intentionally try to prevent it.
Perhaps disabling event handling on all loaded xbl documents would make sense.

Comment 7

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Either of comment 5 or comment 6 makes sense to me. 6 might be a good idea for other reasons, as I doubt we expects events to happen in there.

Comment 8

[Boris Zbarsky [:bzbarsky]]

I like comment 6 to.

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for 1.8

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for trunk

Comment 11

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for 1.9.0

Comment 12

[Olli Pettay [:smaug][[e-mail]]]

I'm not sure if DisableEventHandling is the right name for the method, since
it doesn't prevent running those deprecated event type specific listeners
(nsIFocusListener etc.). Such listeners can be implemented only in C++.

Comment 13

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for trunk

Comment 14

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for 1.9.0

Comment 15

[Olli Pettay [:smaug][[e-mail]]]

Attachment: for 1.8

Comment 16

[Daniel Veditz [:dveditz]]

Comment on attachment 335027 [details] [diff] [review]
for 1.9.0

Approved for 1.9.0.2, a=dveditz for release-drivers.

Comment 17

[Daniel Veditz [:dveditz]]

Comment on attachment 335028 [details] [diff] [review]
for 1.8

Approved for 1.8.1.17, a=dveditz for release-drivers.

Comment 18

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED; I can reproduce using Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16, but not Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17, with the testcase in comment 1.

Replacing fixed1.8.1.17 with verified1.8.1.17.

Comment 19

[Alexander Sack]

Comment on attachment 335028 [details] [diff] [review]
for 1.8

a=asac for 1.8.0.15