639130 - "ASSERTION: Principal mismatch" after using XMLDocument.load on navigated-away document

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Jesse Ruderman]

Attachment: testcase

###!!! ASSERTION: Principal mismatch.  Expect bad things to happen: '!objPrin || objPrin->GetPrincipal() == principal', file js/src/xpconnect/src/xpcwrappednative.cpp, line 3166

###!!! ASSERTION: Principal mismatch.  Not good: 'strcmp(jsClass->name, "Location") == 0 ? NS_SUCCEEDED(CheckSameOriginPrincipal(result, principal)) : result == principal', file caps/src/nsScriptSecurityManager.cpp, line 2503

Comment 1

[Jesse Ruderman]

Attachment: stack traces

Comment 2

[Olli Pettay [:smaug][[e-mail]]]

Attachment: patch

We should remove xmldocument.load at some point. We already warn
"Warning: Use of Document.load() is deprecated. To upgrade your code, use the DOM XMLHttpRequest object. For more help https://developer.mozilla.org/en/XMLHttpRequest
Source File: data:application/xml,<body%20xmlns="http://www.w3.org/1999/xhtml">1</body>
Line: 0"

Comment 3

[Johnny Stenback (:jst)]

So I don't think this is actually an exploitable bug, we're merely running into two different principals from the same origin here. Smaug, if you disagree, please let me know.

Comment 4

[Daniel Veditz [:dveditz]]

Taking Olli's silence as consent. Looks like we block too much access which is the opposite of the security problem of allowing access we shouldn't.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/70d45aaea8ad