Jesse Ruderman Reporter
	Description • 19 years ago

If you hold a reference to |document| and get its location.href after the user
has navigated to another page, you can see the URL of the new page.  

In July 29 builds and earlier, this resulted in a "permission denied" exception.
 I think it should give the URL of the old document, but throwing an exception
is better than giving another URL.

This could be a regression from split windows:

Firefox 1.0.6   -  not vulnerable
Trunk, July 10  -  not vulnerable
Trunk, July 29  -  not vulnerable
Trunk, July 31  -  broken: no error in JS console, crashed once (TB8275556H)
Trunk, Aug 2    -  vulnerable
Trunk, Aug 10   -  vulnerable

	Brendan Eich [:brendan]
	Comment 2 • 19 years ago

jst, can you take this?  If not, brain-dump here and mrbkap or I will.

/be

	Johnny Stenback (:jst) Assignee
	Comment 3 • 19 years ago

Ok. I've got a fix for this in my tree. The fix is to make the inner window hold
the location object and to null out the docshell in it when the inner is torn
down (i.e. when we load a different page). This brings us back to throwing an
exception (though not a security exception) when the location object is used off
of a document that's no longer loaded. Once I have access to a tree clean enough
to create a diff from I'll attach a diff...

	Blake Kaplan (:mrbkap) (inactive)
	Comment 5 • 19 years ago

Comment on attachment 192493 [details] [diff] [review]
Make location be per inner window (and invalidate it when the inner window is no longer the current inner window).

r=me

	Brendan Eich [:brendan]
	Comment 6 • 19 years ago

Comment on attachment 192493 [details] [diff] [review]
Make location be per inner window (and invalidate it when the inner window is no longer the current inner window).

sr=me

Minor thought for later: maybe we should union stuff in nsGlobalWindow.h to
save space at some point.

/be

	Blake Kaplan (:mrbkap) (inactive)
	Comment 7 • 19 years ago

This was fixed by the checkin for bug 303267.

	Daniel Veditz [:dveditz]
	Comment 8 • 19 years ago

Regression due to split windows, not a problem in aviary/1.7 branches

	Bob Clary [:bc] (inactive)
	Comment 9 • 19 years ago

Mozilla 1.7.13/20060213 winxp on attachment 192352 [details] _will_ track the first url loaded.

	Bob Clary [:bc] (inactive)
	Comment 10 • 19 years ago

(In reply to comment #9)
> Mozilla 1.7.13/20060213 winxp on attachment 192352 [details] [edit] _will_ track the first url
> loaded.
> 

Mozilla 1.7.13/20060217 winxp on attachment 192352 [details] _will not_ track the first url
loaded.