468104 - Worker is not subject to CAPS checks

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Giorgio Maone [:ma1]]

Properties of Worker seem not to be checked by CAPS.

Supposing the following properties are set,

user_pref("capability.policy.default.XMLHttpRequest.send", "noAccess");
user_pref("capability.policy.default.Worker.postMessage", "noAccess");

this code throws a security exception as it is supposed to:
new XMLHttpRequest().send(null)

This code doesn't, while it should:
new Worker("somescript.js").postMessage("0")

Comment 1

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.