<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi,</p>
<p><br>
</p>
<p>(CC'ing the list back in)<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 26/10/2018 17:15, <a class="moz-txt-link-abbreviated" href="mailto:sfcheng@gmail.com">sfcheng@gmail.com</a>
wrote:<br>
</div>
<blockquote type="cite" cite="mid:20181026111550597870111@gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<style>body { line-height: 1.5; }blockquote { margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; }p { margin-top: 0px; margin-bottom: 0px; }div.foxdiv20181026105630838122 { }body { font-size: 10.5pt; font-family: 'Segoe UI'; color: rgb(0, 0, 0); line-height: 1.5; }</style>
<div><span></span>Thank you for your answer. I am working on a
custom build of firefox. The window.openDialog is called from
browser.js and the url is under the path <span
style="font-family: ''; font-size: 10.5pt; line-height: 1.5;
background-color: window;"><a class="moz-txt-link-freetext" href="chrome://browser/content/">chrome://browser/content/</a> such as </span><span
style="font-size: 10.5pt; line-height: 1.5; background-color:
window;"><a class="moz-txt-link-freetext" href="chrome://browser/content/test.xul">chrome://browser/content/test.xul</a>. In test.xul,
before closing the dialog, I use
"document.arguments[0].value=****" to set the return value.
This will work just fine. But if I put the xul file under the
local file system, I will get this error: </span><span
style="font-size: 10.5pt; line-height: 1.5; background-color:
window;">Permission denied to access property</span></div>
</blockquote>
<p><br>
</p>
<p>Yes. See
<a class="moz-txt-link-freetext" href="https://developer.mozilla.org/en-US/docs/Mozilla/Gecko/Script_security">https://developer.mozilla.org/en-US/docs/Mozilla/Gecko/Script_security</a>
,
<a class="moz-txt-link-freetext" href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Xray_vision">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Xray_vision</a>
and
<a class="moz-txt-link-freetext" href="https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Language_Bindings/Components.utils.waiveXrays">https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Language_Bindings/Components.utils.waiveXrays</a>
.</p>
<p><br>
</p>
<blockquote type="cite" cite="mid:20181026111550597870111@gmail.com">
<div>The reason for doing this is to save development time. If I
bundle the xul file into the executable, I will have to rebuild
the project every time I make a change.</div>
</blockquote>
<p><br>
</p>
<p>If you're on a Linux or mac system, this shouldn't be the case.
You get a symlink in the build output directory which will
automatically pick up changes. You might need to run Firefox with
the -purgecaches flag to clear any fastload-cached copies of your
file, but you shouldn't need to rebuild the project.</p>
<p><br>
</p>
<p>Even if you're rebuilding, you should be able to do so with
`./mach build faster`, which should take a few seconds on a modern
machine.<br>
</p>
<p><br>
</p>
<blockquote type="cite" cite="mid:20181026111550597870111@gmail.com">
<div> If I can do the same thing by loading XUL file from the file
system directly, I can make live changes and just reload. I was
thinking of adding an exception rule into the security wrapper
to grant such privilege to a particular folder sitting in
parallel with the exe file. But I am pretty new to the code here
and don't know where to locate the part of code responsible for
this. <br>
</div>
</blockquote>
<p><br>
</p>
<p>Hopefully the MDN links help.</p>
<p><br>
</p>
<p>~ Gijs<br>
</p>
<p><br>
</p>
<blockquote type="cite" cite="mid:20181026111550597870111@gmail.com">
<div><span style="font-size: 10.5pt; line-height: 1.5;
background-color: window;"><br>
</span></div>
<div><br>
</div>
<hr style="width: 210px; height: 1px;" size="1" color="#b5c4df"
align="left">
<div><span>
<div style="FONT-SIZE: 10pt; FONT-FAMILY: verdana; MARGIN:
10px">
<div>Rest Regards,</div>
<div>Shanfeng Cheng</div>
<div><a class="moz-txt-link-abbreviated" href="mailto:sfcheng@gmail.com">sfcheng@gmail.com</a></div>
</div>
</span></div>
<blockquote style="margin-top: 0px; margin-bottom: 0px;
margin-left: 0.5em;">
<div> </div>
<div style="border:none;border-top:solid #B5C4DF
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<div style="PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-SIZE:
12px;FONT-FAMILY:tahoma;COLOR:#000000; BACKGROUND: #efefef;
PADDING-BOTTOM: 8px; PADDING-TOP: 8px">
<div><b>From:</b> <a href="mailto:gijskruitbosch@gmail.com"
moz-do-not-send="true">Gijs Kruitbosch</a></div>
<div><b>Date:</b> 2018-10-26 10:54</div>
<div><b>To:</b> <a href="mailto:sfcheng@gmail.com"
moz-do-not-send="true">sfcheng@gmail.com</a>; <a
href="mailto:firefox-dev@mozilla.org"
moz-do-not-send="true">firefox-dev</a></div>
<div><b>Subject:</b> Re: window.openDialog return value</div>
</div>
</div>
<div>
<div class="FoxDiv20181026105630838122">
<p>"It's complicated."</p>
<p>What are you actually trying to do? What does "use an
internal chrome:// url top open a dialog" mean - are you
passing a chrome: URL as the thing/target to open, or are
you calling openDialog from a chrome/system-privileged
context (and if so, what's the target URL, and what other
params are you passing)? Or both? From what "internal
chrome:// url" are you doing this (not all chrome: pages
are equal)? What does "Writing ... doesn't work" mean?
Does it throw an exception? Does reading the value on the
other end throw an exception? Something else?</p>
<p>And what's the wider context here? Are you writing a
patch for Firefox itself, or something else?<br>
</p>
<p>At a guess, it sounds like you might be running into
security wrappers that prevent privileged code from
touching unprivileged non-simple JS things without jumping
through hoops, because doing so is likely to be a security
risk (ie you could end up running arbitrary unprivileged
code in a privileged context and that would be Bad) which
is why it's normally prevented. But that's a guess, and
without more details about what you're doing it's hard to
give a more definitive answer to your question.<br>
</p>
<p>~ Gijs<br>
</p>
<div class="moz-cite-prefix">On 26/10/2018 04:31, <a
class="moz-txt-link-abbreviated"
href="mailto:sfcheng@gmail.com" moz-do-not-send="true">sfcheng@gmail.com</a>
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:2018102522312876799883@gmail.com"
style="margin-top: 0px; margin-bottom: 0px; margin-left:
0.5em;">
<div><span></span>I found that if I use an internal
chrome:// url to open a dialog using window.openDialog,
I can pass back return value using
window.arguments[n].value="*****" just fine. However, if
I use a file from the local file system, I wasn't able
pass back return value. Writing to
window.arguments[n].value doesn't work. I believe there
is some security restriction here. Does anyway know
which part of the C++ code is responsible for defining
the security rules for different url sources?</div>
<div><br>
</div>
<div>Thank you. </div>
<div><br>
</div>
<hr style="width: 210px; height: 1px;" size="1"
color="#b5c4df" align="left">
<div><span>
<div style="FONT-SIZE: 10pt; FONT-FAMILY: verdana;
MARGIN:
 10px">
<div>Rest Regards,</div>
<div>Shanfeng Cheng</div>
<div><a class="moz-txt-link-abbreviated"
href="mailto:sfcheng@gmail.com"
moz-do-not-send="true">sfcheng@gmail.com</a></div>
</div>
</span></div>
<blockquote style="margin-top: 0px; margin-bottom: 0px;
margin-left: 0.5em;">
<div><br>
</div>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
firefox-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:firefox-dev@mozilla.org" moz-do-not-send="true">firefox-dev@mozilla.org</a>
<a class="moz-txt-link-freetext" href="https://mail.mozilla.org/listinfo/firefox-dev" moz-do-not-send="true">https://mail.mozilla.org/listinfo/firefox-dev</a>
</pre>
</blockquote>
</div>
</div>
</blockquote>
</blockquote>
</body>
</html>