Last Comment Bug 756587 - ensure manifest urls belong to same origin
: ensure manifest urls belong to same origin
Product: Firefox
Classification: Client Software
Component: SocialAPI (show other bugs)
: unspecified
: x86 Mac OS X
-- critical (vote)
: ---
Assigned To: Shane Caraveo (:mixedpuppy)
: Shane Caraveo (:mixedpuppy)
Depends on:
Blocks: 733414
  Show dependency treegraph
Reported: 2012-05-18 13:24 PDT by Shane Caraveo (:mixedpuppy)
Modified: 2012-05-23 16:38 PDT (History)
1 user (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image Shane Caraveo (:mixedpuppy) 2012-05-18 13:24:22 PDT
If we load a manifest that is not a resource uri, ensure that the urls are same-origin.
Comment 1 User image Mark Hammond [:markh] 2012-05-20 18:27:51 PDT
Would another option be that we don't support absolute URLs in the manifest, apart from, say, URLPrefix?
Comment 2 User image Shane Caraveo (:mixedpuppy) 2012-05-20 23:17:04 PDT
For the manifest urls, we are absolutely talking same-origin, protocol+host+port.  URLPrefix should only be used in the case we are loading from a resource URI, otherwise it should be ignored.
Comment 3 User image Shane Caraveo (:mixedpuppy) 2012-05-21 14:18:51 PDT
pushed a validation/cleansing function in change
Comment 4 User image Shane Caraveo (:mixedpuppy) 2012-05-23 16:38:43 PDT
pushed tests on this today

Note You need to log in before you can comment on or make changes to this bug.