76137 - Googlesearch javascript gives errors when activated on news.com

Status: VERIFIED INVALID

(Core :: Security, defect)

Description

[Yusuf Goolamabbas]

I have the GoogleSearch javascript code in my toolbar

You can see the link here

http://www.google.com/options/netscape6.html

I am cut/pasting the actual javascript here

javascript:q=document.getSelection();for(i=0;i<frames.length;i++){q=frames[i].document.getSelection();if(q)break;}if(!q)void(q=prompt('Keywords:',''));if(q)location.href='http://www.google.com/search?client=googlet&q='+escape(q)

When I am visiting http://www.news.com/, The above link does not work. I see the
following error in the Javascript console

Error: uncaught exception: [Exception... "Access to property denied"  code:
"1010" nsresult: "0x805303f2 (NS_ERROR_DOM_PROP_ACCESS_DENIED)"  location:
"<unknown>"]

I can't reproduce this problem on other sites though

Comment 1

[Phil Schwartau]

Browser, not engine. Reassigning to Security:General component - 

Comment 2

[ckritzer (gone)]

Hmmnnn.....

I think this is probably due to the fact that http://www.news.com/ is using 
frames, and the NS_ERROR_DOM_PROP_ACCESS_DENIED exception is because the google 
JS is trying to access a different domain, http://news.cnet.com/, which is what 
(I believe) caused the exception to be thrown.  So, the product is actually 
behaving as designed by not allowing one domain to tap into the DOM of a 
different domain.


Marking Bug INVALID, as the product is functioning as designed.


If anyone disagrees, please re-open.

Comment 3

[ckritzer (gone)]

Marking VERIFIED INVALID