846300 - Security Warning messages in console should have associated window ID

Status: NEW

(Core :: General, defect)

Description

[Josh Matthews [:jdm]]

Messages like "Security Error: Content at https://www.google.ro/ may not load data from http://www.youtube.com/" are just the result of LogStringMessage, so they have no associated window. This means they can't be checked for privacy concerns and end up leaking information in the console.

Comment 1

[Josh Matthews [:jdm]]

The following should not be difficult to correct:

http://hg.mozilla.org/mozilla-central/annotate/0a91da5f5eab/content/base/src/nsDataDocumentContentPolicy.cpp#l98
http://hg.mozilla.org/mozilla-central/annotate/0a91da5f5eab/caps/src/nsScriptSecurityManager.cpp#l610
http://hg.mozilla.org/mozilla-central/annotate/0a91da5f5eab/caps/src/nsScriptSecurityManager.cpp#l624

For these, I have no idea:

http://hg.mozilla.org/mozilla-central/annotate/0a91da5f5eab/caps/src/nsNullPrincipal.cpp#l254
http://hg.mozilla.org/mozilla-central/annotate/0a91da5f5eab/caps/src/nsPrincipal.cpp#l384
http://hg.mozilla.org/mozilla-central/annotate/0a91da5f5eab/caps/src/nsPrincipal.cpp#l411
http://hg.mozilla.org/mozilla-central/annotate/0a91da5f5eab/caps/src/nsPrincipal.cpp#l443

Comment 2

[Boris Zbarsky [:bzbarsky]]

Principals are shared across windows in many cases, so....

And I have no idea how you'd annotate CheckSameOriginURI, for that matter.