91215 - Need a way to allow/deny access to Class[any number]

Status: VERIFIED FIXED

(Core :: Security: CAPS, enhancement, P2)

Description

[Jesse Ruderman]

There should be a way to allow or disallow using an object as an array, using
configurable security policies.  Right now I can't even figure out how to allow
it using a line for each array index: setting "Window.0" to allAccess doesn't
allow access to window[0] or window["0"].  Ideally, it would be possible to
allow access to the entire array using one line, but I'm not sure what the line
should be.

One example of how this would be useful:

In bug 45099, [e-mail] wants to set his prefs to allow a web page to access
the "top.frames" array, but in bug 59523, Mitch said he couldn't figure out how
to allow access to window.frames[number] without also allowing access to all
script globals.  (Note that window == window.frames.)

Comment 1

[Mitchell Stoltz (not reading bugmail)]

Target is now 0.9.4, Priority P2.

Comment 2

[Mitchell Stoltz (not reading bugmail)]

Moving to 0.9.5.

Comment 3

[Mitchell Stoltz (not reading bugmail)]

time marches on. Retargeting to 0.9.6.

Comment 4

[Mitchell Stoltz (not reading bugmail)]

Moving the most time-critical bugs and minor security fixes to 0.9.7

Comment 5

[Mitchell Stoltz (not reading bugmail)]

Bug 52920 fixes this for the window object - access to numbered properties or
proerties that are themselves window objects are now not checked. I don't think
there's a need to implement a general fix for XPConnected objects, so I'm
marking this fixed.

Comment 6

[bsharma]

Marking verified as per above developer comments.