Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 6 for web developers

hacks.mozilla.org

Post reply on HN
Print view View original

1–10 of 32 posts

Re: Firefox 6 for web developers

#2

Post by yan »

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however."

Good bye bookmarklets?

Re: Firefox 6 for web developers

#3

Post by int3 »

yan wrote: post #2

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however." G…

I believe bookmarklets still work -- the restriction only applies if the javascript: URIs were typed in by the user.

Re: Firefox 6 for web developers

#4

Post by beaumartinez »

yan wrote: post #2

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however." G…

Interesting. Copying the TinEye bookmarklet,

    javascript:void(window.open('http://tineye.com/search?pluginver=bookmark_1.0&url='%20+%20encodeURIComponent(document.URL)));
into the address bar did nothing; an "Error: uncaught exception: ReferenceError: window is not defined" was logged in the error console.

Clicking it as normal worked as expected, though.

Re: Firefox 6 for web developers

#6

Post by JoshTriplett »

int3 wrote: post #3
yan wrote: post #2

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however." G…

I believe bookmarklets still work -- the restriction only applies if the javascript: URIs were typed in by the user.

Right. Apparently this "security" feature came about because people followed instructions on random facebook pages saying "paste this in your address bar to activate $RANDOM_FAKE_FACEBOOK_FEATURE".

You can still run Javascript via the Scratchpad (Web Developer -> Scratchpad, or hit Shift-F4).

Re: Firefox 6 for web developers

#7

Post by JoshTriplett »

gchucky wrote: post #5

> WebSockets are back! I have a feeling that's going to make a lot of people very happy. Good to see that they were able to solve the security issues.

Server-sent events seem awesome as well. Open a connection to the server, let it stream you events, and each one generates a Javascript event.

Re: Firefox 6 for web developers

#8

Post by simonw »

yan wrote: post #2

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however." G…

Sounds smart. It's extremely easy to get an unsophisticated user (heck, any user who isn't a web developer) to paste a random string of junk in to their URL bar - and doing so is a very nasty XSS vector that works no matter what precautions a site's developers have taken.

I'm sure I've heard of this attack being used successfully on Facebook, spread through messages that say "paste this in to your URL bar to get X".

Re: Firefox 6 for web developers

#9

Post by robin_reala »

gchucky wrote: post #5

> WebSockets are back! I have a feeling that's going to make a lot of people very happy. Good to see that they were able to solve the security issues.

For what it’s worth, you have to update your client code to instantiate a MozWebSocket and update your server to support the latest protocol. I know, because I’ve done this today :) We’re using the em-websocket gem though which has been updated recently so it really wasn’t that difficult.

Re: Firefox 6 for web developers

#10

Post by re »

simonw wrote: post #8
yan wrote: post #2

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however." G…

Sounds smart. It's extremely easy to get an unsophisticated user (heck, any user who isn't a web developer) to paste a random string of junk in to their URL bar - and doing so is a very nasty XSS vector that works no matter what precautions a site's developers have taken. I'm sure I've heard of this attack being used successfully on Facebook, spread through messages that say "paste this in to your URL bar to get X".

So those messages will say "press [whatever key combo activates the console] and paste this text there for a funny video" instead?
Post reply on HN