466082 - nsMsgCookiePolicy::CanAccess doesn't handle external resource documents correctly

Status: RESOLVED FIXED

(MailNews Core :: Security, defect)

Description

[Boris Zbarsky [:bzbarsky]]

Or rather, it won't once the patch for bug 457153 lands (right now it does at the cost of other security issues in the core).  Once that patch lands, this code will need to be updated to use nsILoadContext.

Comment 1

[Boris Zbarsky [:bzbarsky]]

I should note that the incorrectness is not allowing cookies for external resource documents loaded from chrome, so its not like it's a huge issue.  ;)

Comment 2

[Mark Banner (:standard8)]

Can we delay landing bug 457153 until after Thunderbird's Beta 1 is cut? (probably about a week).

It'd certainly be nice if we didn't have to try and fix this before beta as well...

Comment 3

[Boris Zbarsky [:bzbarsky]]

I'm not going to land bug 457153 until after Firefox b2 is cut at this point, so that might work.  Note that I was going to post a patch for this bug once it becomes relevant.

I do want to land bug 457153 as soon as I can, so it can get as much testing as possible.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Well, I was wrong.  Bug 457153 did in fact make b2 (had to, due to extension compat issues).  Patch for this bug coming up.

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Fix

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: With the include, too

Comment 7

[Mark Banner (:standard8)]

So I think this should probably be blocking b1 as it clearly indicates a regression in cookie handling until we fix this.

Comment 8

[Dan Mosedale (:dmosedale, :dmose)]

Comment on attachment 349785 [details] [diff] [review]
With the include, too

Looks good; r+sr=dmose.  Thanks for the patch, bz!

Comment 9

[Boris Zbarsky [:bzbarsky]]

Pushed http://hg.mozilla.org/comm-central/rev/30012575b886