62168 - script can't close windows from a different host

Status: VERIFIED FIXED

(Core :: Security, defect, P3)

Description

[Mitchell Stoltz (not reading bugmail)]

Attempting to call close() on a window object containing a page from a different
host as the calling script throws a DOM access denied exception. Scripts should
be able to close any window that was opened by script (enforcing the 'opened by
script' part is a different bug).

The code is:

w=window.open("http://www.netscape.com","mywin");
setTimeout("w.close()", 4000);

The security manager does a check on script globals (presumably on 'w') which
fails because w is seen as belonging to the www.netscape.com host, while the
calling script is coming from somewhere else. This seems incorrect.

Strangely, the following code works:
w=window.open("http://www.netscape.com","mywin");
setTimeout("w.location = 'http://www.mozilla.org'", 4000);

In this case, the DOM never does a security check on access to 'w,' but only for
access to 'location,' which is writeable by anyone.

Comment 1

[Mitchell Stoltz (not reading bugmail)]

cc'ing jst.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

*** Bug 36050 has been marked as a duplicate of this bug. ***

Comment 3

[Mitchell Stoltz (not reading bugmail)]

Mass changing milestones to Moz0.9.1. Many of these bugs are dependent on the
XPConnected DOM and its associated security UI changes.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Fixed.

Comment 5

[ckritzer (gone)]

http://voodoolady/bugzilla/bugzilla62168.html = testcase.

Blocked by bug#82159

Comment 6

[ckritzer (gone)]

Okay, this seems to be working now.
Marking VERIFIED FIXED on:
-MacOS91 2001-06-01-08-trunk
-Win98SE 2001-06-01-06-trunk
-LinRH62 2001-06-01-08-trunk