768990 - about:blocked produces a Security Error on favicon load

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[rtrappman]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:13.0) Gecko/20100101 Firefox/13.0.1
Build ID: 20120614114901

Steps to reproduce:

Visiting the malware or phishing block page.


Actual results:

Favicon does not load when the about:blocked page is encountered due to the below Security Error found in the Error Console.


"Security Error: Content at about:blocked may not load or link to chrome://global/skin/icons/blacklist_favicon.png"


Expected results:

about:blocked should be allowed to access resources in chrome://

Comment 1

[rtrappman]

Still occurring as of 16.0.1

Comment 2

[Andrei Vaida [:avaida]]

I was able to reproduce this issue under Windows 7 x64 using:
- latest Aurora (BuildID: 20131209004003): Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0,
- latest Nightly (BuildID: 20131205030207): Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:28.0) Gecko/20100101 Firefox/28.0,
- Firefox 27.0b1 (BuildID: 20131209204824): Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0,
- Firefox RC 4.0 (BuildID: 20110318052756): Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0.

This issue is not a regression.

Accessing a "suspicious" page (e.g. http://code.eligrey.com/sec/firefox/about-blocked/demo.html) does not trigger the error.

I managed to reproduce a similar error for the about:certerror page, which throws:

> Security Error: Content at about:certerror may not load or link to chrome://global/skin/icons/warning-16.png.