Firefox 6 for web developers

Re:Firefox 6 for web developers by yan on Tuesday August 16, 2011 @12:05PM (#2891690)

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however."

Good bye bookmarklets?

[ Parent | on HN ]

Re:Firefox 6 for web developers by simonw on Tuesday August 16, 2011 @12:30PM (#2891791)

Sounds smart. It's extremely easy to get an unsophisticated user (heck, any user who isn't a web developer) to paste a random string of junk in to their URL bar - and doing so is a very nasty XSS vector that works no matter what precautions a site's developers have taken.

I'm sure I've heard of this attack being used successfully on Facebook, spread through messages that say "paste this in to your URL bar to get X".

[ Parent | on HN ]

Re:Firefox 6 for web developers by re on Tuesday August 16, 2011 @12:46PM (#2891860)

So those messages will say "press [whatever key combo activates the console] and paste this text there for a funny video" instead?

[ Parent | on HN ]

Re:Firefox 6 for web developers by pbhjpbhj on Wednesday August 17, 2011 @06:09AM (#2894759)

Or possibly "drag this link to the toolbar and click when on any page on Facebook to see which of your friends is viewing that page" or whatever.

[ Parent | on HN ]

Re:Firefox 6 for web developers by int3 on Tuesday August 16, 2011 @12:09PM (#2891704)

I believe bookmarklets still work -- the restriction only applies if the javascript: URIs were typed in by the user.

[ Parent | on HN ]

Re:Firefox 6 for web developers by JoshTriplett on Tuesday August 16, 2011 @12:27PM (#2891779)

Right. Apparently this "security" feature came about because people followed instructions on random facebook pages saying "paste this in your address bar to activate $RANDOM_FAKE_FACEBOOK_FEATURE".

You can still run Javascript via the Scratchpad (Web Developer -> Scratchpad, or hit Shift-F4).

[ Parent | on HN ]

Re:Firefox 6 for web developers by beaumartinez on Tuesday August 16, 2011 @12:17PM (#2891740)

Interesting. Copying the TinEye bookmarklet,

    javascript:void(window.open('http://tineye.com/search?pluginver=bookmark_1.0&url='%20+%20encodeURIComponent(document.URL)));

into the address bar did nothing; an "Error: uncaught exception: ReferenceError: window is not defined" was logged in the error console.

Clicking it as normal worked as expected, though.

[ Parent | on HN ]

Re:Firefox 6 for web developers by ck2 on Tuesday August 16, 2011 @02:08PM (#2892242)

Hopefully there is an about:config to undo that for power-users.

[ Parent | on HN ]

Re:Firefox 6 for web developers by josscrowcroft on Tuesday August 16, 2011 @10:03PM (#2893720)

Yeah, I caught this hanging out at the bottom of the list too... Immediately set to thinking how I'm gonna have to go rewrite the dozen or so bookmarklets I've written to support FF6

[ Parent | on HN ]

Re:Firefox 6 for web developers by mbrubeck on Wednesday August 17, 2011 @12:10AM (#2894054)

Bookmarklets are not affected when used as bookmarks. Only URIs typed directly into the location bar are affected.

[ Parent | on HN ]

Re:Firefox 6 for web developers by josscrowcroft on Wednesday August 17, 2011 @10:44PM (#2897761)

Oh, sweet.

[ Parent | on HN ]