Binding XBL to HTML apparently ceased to work

[esquifit]

A couple of days ago, my xbl bindings to HTML pages ceased to work.

I attached XBL bindings to arbitrary pages. In order to circumvent the
limitations imposed by the
same-origin policy (see [1]), I did the following:

1) With the aid of the Stylish extension, I attached a one-line style
to every html page (alternatively the userChrome.css file can be
used). This style consists of a CSS @import directive:

@import url("http://gist.github.com/raw/211181/
b0ad704fd439e774b986fecb7a5a36038d3040c7/OPAC_Muenchen.css");

2) In the CSS style hosted at gist.github.com, I do the xbl bindings
to
the relevant web pages. The bound XBL files are also hosted at
gist.github.com, so the same origin policy applies.

This can be tested on

https://ssl.muenchen.de/EF/opac.html

Among the expected results, the selection box "Treffer/Seite" should
contain the options 5, 10, 20, 20, 50, 100, 200, 500, 1000 instead of
the default 5, 10, 20.

As I said, this worked fine for about a year until a couple of days
ago. Presently, the elements bound to XBL are being completely hidden.
Firebug shows the style as being applied. The whole thing still does
work if everything, including the HTML page, is hosted locally and the
'file:' scheme is used. . I couldn't found another way to debug this.

Any ideas?

[1] http://groups.google.com/group/mozilla.dev.tech.xbl/msg/5a600a1373465de6

[Boris Zbarsky]

On 10/16/09 6:33 AM, esquifit wrote:
> A couple of days ago, my xbl bindings to HTML pages ceased to work.

On which branch?

> I attached XBL bindings to arbitrary pages. In order to circumvent the
> limitations imposed by the
> same-origin policy (see [1]), I did the following:
>
> 1) With the aid of the Stylish extension, I attached a one-line style
> to every html page (alternatively the userChrome.css file can be
> used). This style consists of a CSS @import directive:
>
> @import url("http://gist.github.com/raw/211181/
> b0ad704fd439e774b986fecb7a5a36038d3040c7/OPAC_Muenchen.css");

So the stylesheet doing the xbl load is at that http URL, and in
particular is NOT a user or UA sheet.

Since it's not a user or UA sheet, the load is only allowed if the xbl
is same-origin with the stylesheet _and_ with the page the XBL is being
bound to, per the message you cite.

This hasn't changed recently, to my knowledge.

-Boris