Open Bug 742654 Opened 10 years ago Updated 4 years ago

Registering a Protocol and Content handler is not implementing the schemes(http/https) as different origins


(Core :: DOM: Core & HTML, defect, P5)

11 Branch
Windows 7





(Reporter: achin.nitk, Unassigned)


User Agent: Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0
Build ID: 20120312181643

Steps to reproduce:

I tried registering a protocol handler from a webpage which had the scheme(HTTP/HTTPS) different from the Handler itself.

http://localhost/protocolHandler/registerProtocolHandler.html is the webpage used for registering

Script for registering 
navigator.registerProtocolHandler('web+mystuff', 'https://localhost/protocolHandler/handler.php?value=%s', 'My App');

Similar stuff I did for a content handler

Actual results:

Firefox allowed registering of the handler irrespective of the Scheme (Http/Https) or origin.

Expected results:

It should have thrown a security error because origin is different
Component: Untriaged → DOM: Core & HTML
Product: Firefox → Core

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.
Priority: -- → P5
You need to log in before you can comment on or make changes to this bug.