596634 - accessing XMLHttpRequest.statusText throws NS_ERROR_NOT_AVAILABLE exception when doing cross-origin requests and getting a 500 server response

Status: RESOLVED DUPLICATE of bug 597301

(Core :: DOM: Core & HTML, defect)

Description

[Nicolas]

User-Agent:       Opera/9.80 (Windows NT 6.0; U; fr) Presto/2.6.35 Version/10.70
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.9.2.9) Gecko/20100824 Firefox/3.6.9 (.NET CLR 3.5.30729)

When doing XHR level 2 cross-origin requests and getting a 500 server response, it's not possible to access xhr.statusText. It throws this exception:

Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIXMLHttpRequest.statusText]

Note that status is incorrectly set to 0, and responseText is empty (although the server sent something).

Notes: 
 - XHR level 1 (same domain) and 500 server response work as expected (statusText can be accessed, status is set to 500 and responseText isn't empty, as expected)
 - problem happens in both POST and GET requests
 - Here is an example of server response that shows the problem: http://www.warpdesign.fr/tests/response.php?type=500

Reproducible: Always

Steps to Reproduce:
1. send an XHR to the following address ttp://www.warpdesign.fr/tests/response.php?type=500
2. try to access xhr.statusText
3.
Actual Results:  
Throws the exception:

Component returned failure code: 0x80040111 (NS_ERROR_NOT_AVAILABLE) [nsIXMLHttpRequest.statusText]

And status is set to 0, responseText is empty

Expected Results:  
Getting the actual value of xhr.statusText, having status set to 500, and responseText should contain the server response

Notes: 
 - XHR level 1 (same domain) and 500 server response work as expected (statusText can be accessed, status is set to 500 and responseText isn't empty, as expected)
 - problem happens in both POST and GET requests
 - Here is an example of server response that shows the problem: http://www.warpdesign.fr/tests/response.php?type=500

Comment 1

[Nickolay_Ponomarev]

Can you reproduce on Firefox 4 beta? Could you attach a test page?

Comment 2

[Boris Zbarsky [:bzbarsky]]

This is done on purpose, for failed cross-site requests:


1317     if (mState & XML_HTTP_REQUEST_USE_XSITE_AC) {
1318       // Make sure we don't leak status information from denied cross-site
1319       // requests.
1320       if (mChannel) {
1321         nsresult status;
1322         mChannel->GetStatus(&status);
1323         if (NS_FAILED(status)) {
1324           return NS_ERROR_NOT_AVAILABLE;
1325         }
1326       }
1327     }

See also bug 552090.  The xpec probably needs to be updated to handle this; right now it seems to require a security hole.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Actually, this should get fixed by the patch in bug 597301.

The spec now explicitly says that a non-2xx responses can still pass the security checks. As long as they have the appropriate headers of course.