474744 - "ASSERTION: This is unsafe" with bogus protocol, setting innerHTML

Status: RESOLVED WORKSFORME

(Core :: General, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: This is unsafe: 'nsContentUtils::IsSafeToRunScript()', file /Users/jruderman/central/layout/base/nsDocumentViewer.cpp, line 1072

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Shouldn't <video> handle bogus protocol the same way as <img>, fire an error event?

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

For <img> content policies seems to prevent this.
Bug 451004 is about adding content policies checks for <video>.

We could change both <img> and <audio>/<video> to start loading using
a script runner, or perhaps for 1.9.1 it is enough to add content
policies for <audio>/<video> (Bug 451004 is P1 blocking1.9.1+)

Comment 3

[Boris Zbarsky [:bzbarsky]]

> We could change both <img> and <audio>/<video> to start loading using
> a script runner

That involves one extra heap-allocation per image, no?  I'm not sure I like the performance impact there...

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

This is now WFM in the latest trunk.

Comment 5

[Jesse Ruderman]

Yep.  I'll add a crashtest.