792532 - new about:blank context should be created for loads of javascript: URIs that can't inherit the current page's principal

Status: RESOLVED WONTFIX

(Core :: DOM: Navigation, defect)

Description

[:Gavin Sharp [email: [e-mail]]]

This would fix bug 728313 without regressing bug 656433. It would also make non-malicious javascript: URIs like "javascript:alert(1)" work again.

Comment 1

[:Gavin Sharp [email: [e-mail]]]

See attachment 600103 [details] [diff] [review] from bug 728313 for a failed stab in the dark that I took at this.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Hmm.  So instead of running the JS in a sandbox we would nuke the existing page and run it against the new about:blank?

That might be ok, yes....

Comment 3

[Boris Zbarsky [:bzbarsky]]

As long as we make sure web pages can't trigger it.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Yeah, exactly. I guess the nuking of the existing page could be annoying, given previous behavior, but I think it's probably better than the current behavior.

Comment 5

[:Gijs (he/him)]

This showed up in my search results. Given bug 728313 is now fixed, I'm going to suggest wontfixing this. Changing how we load JS URIs in this way seems... a bit scary, and I don't see a good reason to do it anymore. Boris, does that sound OK?

Comment 6

[Boris Zbarsky [:bzbarsky]]

That seems fine to me.