Boris Zbarsky [:bzbarsky] Reporter
	Description • 18 years ago

We seem to have some inconsistent security checks.  See details in bug 344890 comment 8.

This bug is _solely_ about this inconsistency.  Please do not admix any of the other discussion from bug 344890 here.

I suspect the problem is that needsSecurityCheck is returning a cached false when it shouldn't (because while the cx is the same the principal on the stack is not).  I haven't had a chance to verify this, however.  While this is not going to cause problems for XPConnect stuff, for non-XPConnect JS variables on pages this could be bad.

	Boris Zbarsky [:bzbarsky] Reporter
	Comment 1 • 18 years ago

So if I make needsSecurityCheck always return PR_TRUE, this bug goes away.

The basic first problem is that needsSecurityCheck assumes that code running on a given cx always has the same principal.  That's a pretty bogus assumption, and is what's biting us here -- it lets code with the null principal get at and call |foo|.

Imo we should make the cache be per-JSStackFrame or something...

	Mike Schroepfer
	Comment 2 • 18 years ago

So bz - is this/should this be something we try and get in 1.8.1?

	Boris Zbarsky [:bzbarsky] Reporter
	Comment 3 • 18 years ago

I think so, yes.  Though changes for bug 351370 might make things better here... maybe.  Not sure.

	Mike Schroepfer
	Comment 4 • 18 years ago

pushing to 1.8.1.1...

	Daniel Veditz [:dveditz]
	Comment 5 • 18 years ago

Restoring lost blocking flag

	Daniel Veditz [:dveditz]
	Comment 6 • 18 years ago

Not clear we know what the fix is going to be here, not blocking the current release (though we'll consider taking a patch) but putting on a later radar.

	Damon Sicore (:damons)
	Comment 7 • 17 years ago

Johnny, can you please take this?

	Damon Sicore (:damons)
	Comment 8 • 17 years ago

Setting to B1 per conversation with JST.

	Johnny Stenback (:jst) Assignee
	Comment 9 • 17 years ago

The offending code here is no longer in the tree thanks to mrbkap's cross origin wrapper changes. Marking bug FIXED.