494535 - Code preview page does not show code from data: URIs

Status: RESOLVED DUPLICATE of bug 496197

(Mozilla Labs :: Jetpack Prototype, defect)

Description

[Eli Grey (:sephr)]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.10) Gecko/2009042523 Ubuntu/9.04 (jaunty) Firefox/3.0.10 GTB5
Build Identifier: 

The JavaScript code preview page does not show code from data: URIs. This bug applies to Jetpack and Ubiquity. This bug might make it possible to trick foolish users into installing malicious Jetpack Features/Ubiquity commands.

Reproducible: Always

Steps to Reproduce:
1. Make an html page with <link rel="jetpack" href="data:application/javascript,//some-code"/>
Actual Results:  
Displays "Loading code, please wait..." where the code should be.

Expected Results:  
Displays the code. (instantaneously at that as it's a data: URI and there should be no significant delay)

Comment 1

[Atul Varma [:atul]]

Thanks for the report!  For now, using data: URIs is a bit problematic because of the fact that the original HTML page from which a Jetpack's code href is found isn't checked during the auto-update process--which means that whenever the data: URI changes, the changes won't ever result in an auto-update for users of that Jetpack for the time being.

So for now, we'll just disable the ability to subscribe to data: URIs entirely:

  http://hg.mozilla.org/labs/jetpack/rev/8a361aefc2bc

I'm marking this bug as a duplicate of the more general issue that data: URIs are unsupported as Jetpack code URLs.