Sat, 03 Jan 2015 20:18:00 +0100
Conditionally enable double key logic according to:
private browsing mode or privacy.thirdparty.isolate preference and
implement in GetCookieStringCommon and FindCookie where it counts...
With some reservations of how to convince FindCookie users to test
condition and pass a nullptr when disabling double key logic.
1 <!DOCTYPE HTML>
2 <html>
3 <!--
4 https://bugzilla.mozilla.org/show_bug.cgi?id=423375
5 -->
6 <head>
7 <title>Test for Bug 423375</title>
8 <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
9 <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
10 </head>
11 <body>
12 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=423375">Mozilla Bug 423375</a>
13 <p id="display"></p>
14 <div id="content" style="display: none">
15 <iframe id="load-frame"></iframe>
16 </div>
17 <pre id="test">
18 <script class="testbody" type="text/javascript">
20 /**
21 ** Test for Bug 423375
22 ** (content shouldn't be able to load chrome: or resource:)
23 **/
24 function tryLoad(url)
25 {
26 try {
27 window.frames[0].location = url;
28 return "loaded";
29 } catch (e if /Access.*denied/.test(String(e))) {
30 return "denied";
31 } catch (e) {
32 return "unexpected: " + e;
33 }
34 }
36 is(tryLoad("chrome://global/content/mozilla.xhtml"), "denied",
37 "content should have been prevented from loading chrome: URL");
38 is(tryLoad("resource://gre-resources/html.css"), "denied",
39 "content should have been prevented from loading resource: URL");
40 </script>
41 </pre>
42 </body>
43 </html>