Adam Lock Reporter
	Description • 23 years ago

I noticed a potentially serious problem while fixing up some scheme comparison
code in SameOrSubdomainOfTarget() in nsDocShell.cpp for bug 126432.

I have noticed that this code only gets called if mValidateOrigin is PR_TRUE but
it isn't. In fact mValidateOrigin never gets initialised at all!

Potentially, mValidateOrigin should be set in the nsDocShell constuctor by
reading the pref "browser.frame.validate_origin" but this pref does not exist so
presumably mValidateOrigin contains garbage.

So there is a security issue here. What should be done? My guess is that 
"browser.frame.validate_origin" should exist in all.js and mValidateOrigin
should default to PR_TRUE. Also if this code path has not been triggered for a
while it should be re-verified to ensure it is working properly.

	Adam Lock Reporter
	Comment 1 • 23 years ago

Patch in bug 126432 sets mValidateOrigin to PR_TRUE during construction

	Boris Zbarsky [:bzbarsky]
	Comment 2 • 18 years ago

This was fixed by the changes in bug 246923.