Closed Bug 1300778 Opened 8 years ago Closed 8 years ago

RemotePageManager.jsm should not use window.document.documentURI to identify websites

Categories

(Core :: DOM: Content Processes, defect)

Product:
Core
Component:
DOM: Content Processes
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED INVALID

People

(Reporter: freddy, Unassigned)

References

Details

Snippets of affected code: > this.messageManager.sendAsyncMessage("RemotePage:InitPort", { > portID: portID, > url: window.document.documentURI.replace(/[\#|\?].*$/, ""), > }); and > let url = window.document.documentURI.replace(/[\#|\?].*$/, ""); > if (!registeredURLs.has(url)) Christoph (in CC) said documentURI can be clobbered, so we should prefer |window.location.origin|
Blocks: 1040184
documentURI is readonly.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → INVALID
Can this be made public then?
Flags: needinfo?(fbraun)
Yes. The bug is invalid.
Flags: needinfo?(fbraun)
Group: core-security
You need to log in before you can comment on or make changes to this bug.