497770 - Setting the slider url to certain websites completely takes over the browser

Status: RESOLVED FIXED

(Mozilla Labs :: Jetpack Prototype, defect)

Description

[James]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4
Build Identifier: .2

Certain websites like myspace.com and the gmail popup window cause the slider to take up the whole the whole browser. Tabs lockup and all. If you close all windows and disable javascript you can uninstall the jetpack and get back to normal.

Reproducible: Always

Steps to Reproduce:
Just make a jetpack with the following:

jetpack.future.import("slideBar");
jetpack.slideBar.append({
  icon: "http://gmail.com/favicon.ico",
  url: "http://mail.google.com/mail/?ui=2&ik=bd6d42e1dc&view=cm&fs=1&tf=1&ver=wi-f1CYV_Pk.en.&am=b3EopdTncGGRBPV60fT2SvIXIXQh3A#cmid%253D2",
  width: 500,
  onSelect: function(slide) slide({ size: 500 }), 
});

Comment 1

[Ed Lee :Mardak]

The website is probably grabbing at top and somehow eventually getting to the browser and changing the location.

SlideBar needs to wrap the frame to only allow access to certain properties.

Comment 3

[Ed Lee :Mardak]

http://hg.mozilla.org/labs/jetpack/rev/5e2c8d34e782
Use a xul:iframe and set the type="content" and work around content-over-everything bug by display: none not-selected iframes.