[tor-bugs] #2874 [Firefox Patch Issues]: Block access to Components.interfaces from content script

[Tor Bug Tracker & Wiki]

#2874: Block access to Components.interfaces from content script
-------------------------------------+-------------------------------------
     Reporter:  mikeperry            |      Owner:  mikeperry
         Type:  enhancement          |     Status:  reopened
     Priority:  normal               |  Milestone:
    Component:  Firefox Patch        |    Version:
  Issues                             |   Keywords:
   Resolution:                       |  MikePerryIterationFires20110529,
Actual Points:  1                    |  backport-to-mozilla
       Points:  4                    |  Parent ID:
-------------------------------------+-------------------------------------
Changes (by arthuredelstein):

 * status:  closed => reopened
 * resolution:  fixed =>
 * parent:  #2871 =>


Comment:

 In trying to rebase this patch to ESR31, I discovered that it's still
 possible to access `Components.interfaces` from content scripts.

 Here is a demo. Try with TorBrowser 3.6.3 and JavaScript active.
 https://arthuredelstein.github.io/tordemos/bug2874.html

 Also works with latest version of Firefox. (I presume with ESR31 as well.)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2874#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online