data: page can't window.open and then document.write twice

VERIFIED FIXED in mozilla0.9.1

Status

()

P3
normal
VERIFIED FIXED
18 years ago
16 years ago

People

(Reporter: jruderman, Assigned: security-bugs)

Tracking

Trunk
mozilla0.9.1
x86
Windows 98
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

18 years ago
Steps to reproduce:
1. Run Mozilla with -console to see error messages
2. Load data:text/html,quux
3. Type into urlbar: javascript:with(window.open("about:blank").document){write
("foo"); write("bar");}

The code works fine at http urls, file urls, and about:blank, but at 
data:text/html urls, the second write() fails with 
NS_ERROR_DOM_PROP_ACCESS_DENIED.  I get the same results using the script as a 
url in the urlbar, as a personal toolbar bookmarklet, as a javascript: link in 
the data page, or as a <script> in the data page.


This equivalent code will fail under the same circumstances and may be easier 
to use for debugging:

javascript:x=window.open("about:blank").document;x.write("foo");x.write("bar");


I noticed the problem while using the DOM property tree bookmarklet at 
http://www.cs.hmc.edu/~jruderma/mozilla/proptree/ as a personal toolbar link.
(Reporter)

Comment 1

18 years ago
Same thing happens when you start at a javascript: url instead of a 
data:text/html url (for example, javascript:4).

Updated

18 years ago
QA Contact: czhang → junruh

Comment 2

18 years ago
Mass changing QA to ckritzer.
QA Contact: junruh → ckritzer
(Assignee)

Comment 3

18 years ago
Mass changing milestones to Moz0.9.1. Many of these bugs are dependent on the
XPConnected DOM and its associated security UI changes.
Status: NEW → ASSIGNED
Target Milestone: --- → mozilla0.9.1
(Assignee)

Comment 4

18 years ago
I can't reproduce this anymore, so I guess it's fixed.
Status: ASSIGNED → RESOLVED
Last Resolved: 18 years ago
Resolution: --- → FIXED

Comment 5

18 years ago
Currently blocked by bug#82159
Depends on: 82159

Comment 6

18 years ago
Marking VERIFIED FIXED on:
-MacOS91 2001-06-01-08-trunk
-Win98SE 2001-06-01-06-trunk
-LinRH62 2001-06-01-08-trunk
Status: RESOLVED → VERIFIED

Updated

16 years ago
Blocks: 144766
You need to log in before you can comment on or make changes to this bug.