801260 - inbound images in e html mails

Status: RESOLVED INCOMPLETE

(Thunderbird :: Message Compose Window, defect)

Description

[smarttemplate4]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0
Build ID: 20121010144125

Steps to reproduce:

If i display a message which contains inbound images something like in this scheme <a href="urlToFile/Filename.jpg"></a>
Or images which i have insert in compose with the filepicker and display after sending


Actual results:

This causes mutiple logs in console something like (sorry german log only)

Sicherheitsfehler: Inhalt auf moz-nullprincipal:{9fb089bf-e9f2-4ddb-bb49-a0cbc4e3655c} darf mailbox:///D:/Mozilla%20Profile/Thunderbird/Profiles/Marc/XXX/XXX/Drafts?number=1825101&header=filter&emitter=js&part=1.1.2&filename=image.png nicht laden oder verlinken.

- and -

Sicherheitsfehler: Inhalt auf moz-nullprincipal:{08bb514e-65e9-4dd7-8b51-e4e364cad2dd} darf about:blank nicht laden oder verlinken.


Expected results:

simple: this logs should not occur...
BTW: what means this log? 
What is wrong?

Comment 1

[Wayne Mery (:wsmwk)]

MarkyMarkDE Did you make the nomination at https://wiki.mozilla.org/Thunderbird/Papercuts ?

How is this of major daily impact to the average user?

Comment 2

[smarttemplate4]

yes i have put this bug in the papercuts.
But currently this log is gone by unknown reasons... this log had occur since really long time.

Comment 3

[smarttemplate4]

Wayne: since TB31 this Log occurs again...
now i think the daily average user will not see from but the advanced user can see this logs in error console and he will ask too what this means and what maybe not working now...

Comment 4

[smarttemplate4]

i have found something interesting:
"WireTap Remote Web Vulnerability" this was from TB 17.0.6 and maybe the fix isn't landed or the fix is broken again, a skilled programmer should take a look on it
http://www.securityfocus.com/archive/1/530893/30/0/threaded

Comment 5

[Jorg K (CEST = GMT+2)]

Image inclusion into the compose windows has completely changed in TB 52. Whatever happened in versions before that can now not be reproduced.

Note that image inclusion will still print security errors in the error console. That's be design since images are initially blocked and we programmatically included them in the error handler here:
https://searchfox.org/comm-central/rev/266e9cc242cd0de076e85eb4aa0b8392fcb2ca01/mail/components/compose/content/MsgComposeCommands.js#7580