Closed Bug 756587 Opened 9 years ago Closed 9 years ago

ensure manifest urls belong to same origin

Categories

(Firefox Graveyard :: SocialAPI, defect)

x86
macOS
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED FIXED

People

(Reporter: mixedpuppy, Assigned: mixedpuppy)

References

Details

(Whiteboard: [needs-test])

If we load a manifest that is not a resource uri, ensure that the urls are same-origin.
Would another option be that we don't support absolute URLs in the manifest, apart from, say, URLPrefix?
For the manifest urls, we are absolutely talking same-origin, protocol+host+port.  URLPrefix should only be used in the case we are loading from a resource URI, otherwise it should be ignored.
Assignee: nobody → mixedpuppy
pushed a validation/cleansing function in change https://github.com/mozilla/socialapi-dev/commit/3a731bfad4e4a861b17be5e3e0048f6e480dc143
Whiteboard: [needs-test]
pushed tests on this today https://github.com/mozilla/socialapi-dev/commit/f9d2f6388b219df49e9809fb3a85b3d9e8f0e3a0
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → FIXED
Product: Firefox → Firefox Graveyard
You need to log in before you can comment on or make changes to this bug.