Open Bug 742654 Opened 9 years ago Updated 2 years ago

Registering a Protocol and Content handler is not implementing the schemes(http/https) as different origins

Categories

(Core :: DOM: Core & HTML, defect, P5)

11 Branch
x86
Windows 7
defect

Tracking

()

UNCONFIRMED

People

(Reporter: achin.nitk, Unassigned)

Details

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0
Build ID: 20120312181643

Steps to reproduce:

I tried registering a protocol handler from a webpage which had the scheme(HTTP/HTTPS) different from the Handler itself.

http://localhost/protocolHandler/registerProtocolHandler.html is the webpage used for registering

Script for registering 
navigator.registerProtocolHandler('web+mystuff', 'https://localhost/protocolHandler/handler.php?value=%s', 'My App');

Similar stuff I did for a content handler




Actual results:

Firefox allowed registering of the handler irrespective of the Scheme (Http/Https) or origin.


Expected results:

It should have thrown a security error because origin is different
Component: Untriaged → DOM: Core & HTML
Product: Firefox → Core
https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.
Priority: -- → P5
You need to log in before you can comment on or make changes to this bug.