Differences in XBL bindings between Firefox 2 and 3

[esquifit]

Using the file userContent.css in my Fiferox 2 profile, I've attached
an XBL binding to a select box ("Treffer/Seite") in the following
page:

https://ssl.muenchen.de/EF/opac.html

The binding is:

@-moz-document url("https://ssl.muenchen.de/EF/opac.html"),
url("https://ssl.muenchen.de/AK/opac.html") {
select.input[name="NNORRQ"] {
-moz-binding:url(http://esquifit.googlepages.com/
listsize_2.xml#listsize) !important;
}
}

This extends the available values of the select box to a couple of
additional values. It works fine. In Firefox 2. In Firefox 3 (RC1) it
doesn't anymore.

Questions:
1) Is this a bug, or something has changed between FF2 and FF3? (same
origin policy, different protocols, something like that)
2) If something has changed, is there any doc/reference where the
expected behaviour is explained (besides the source code, of course)?

According to MDC, starting with Firefox3 it should be possible to use
data: urls for bindings; I've also tried with:

@-moz-document url("https://ssl.muenchen.de/EF/opac.html"),
url("https://ssl.muenchen.de/AK/opac.html") {
select.input[name="NNORRQ"] {
-moz-binding: url(data:text/
xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iSVNPLTg4NTktMSI/
Pg0KPGJpbmRpbmdzIHhtbG5zPSJodHRwOi8vd3d3Lm1vemlsbGEub3JnL3hibCI
+DQogICAgPGJpbmRpbmcgaWQ9Imxpc3RzaXplIj4gICAgICAgIA0KICAgICAgICA8aW1wbGVtZW50YXRpb24+DQogICAgICAgICAgICA8Y29uc3RydWN0b3I
+DQogICAgICAgICAgICAgICAgPCFbQ0RBVEFbDQogICAgICAgICAgICAgICAgICAgIHZhciBuZXdPcHRpb24gPSBmdW5jdGlvbihzZWxFbG0sIHZhbCl7DQogICAgICAgICAgICAgICAgICAgICAgICB2YXIgc2VsID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnT1BUSU9OJyk7DQogICAgICAgICAgICAgICAgICAgICAgICBzZWwuc2V0QXR0cmlidXRlKCd2YWx1ZScsIHZhbCk7DQogICAgICAgICAgICAgICAgICAgICAgICBzZWwuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlVGV4dE5vZGUodmFsKSk7DQogICAgICAgICAgICAgICAgICAgICAgICAvL3RoaXMuYXBwZW5kQ2hpbGQoc2VsKTsNCiAgICAgICAgICAgICAgICAgICAgICAgIHNlbEVsbS5pbnNlcnRCZWZvcmUoc2VsLHNlbEVsbS5maXJzdENoaWxkKTsNCiAgICAgICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgICAgICBuZXdPcHRpb24odGhpcywgJzUwJyk7DQogICAgICAgICAgICAgICAgICAgIG5ld09wdGlvbih0aGlzLCAnMTAwJyk7DQogICAgICAgICAgICAgICAgICAgIG5ld09wdGlvbih0aGlzLCAnMjAwJyk7DQogICAgICAgICAgICAgICAgICAgIG5ld09wdGlvbih0aGlzLCAnNTAwJyk7DQogICAgICAgICAgICAgICAgICAgIG5ld09wdGlvbih0aGlzLCAnMTAwMCcpOw0KICAgICAgICAgICAgICAgIF1dPg0KICAgICAgICAgICAgPC9jb25zdHJ1Y3Rvcj4gDQogICAgICAgIDwvaW1wbGVtZW50YXRpb24+DQogICAgPC9iaW5kaW5nPiAgICAgICAgDQo8L2JpbmRpbmdzPg0KDQo8IS0tIHZpbTpzeW50YXg9eG1sOnN3PTQ6dHM9NA0KLS0+DQo=)
!important;}

but is doesn't work either. Any clue?

[Boris Zbarsky]

esquifit wrote:
> 1) Is this a bug, or something has changed between FF2 and FF3? (same
> origin policy, different protocols, something like that)

The latter. XBL can now only be loaded from the same origin as the origin doing
the loading (the CSS file in this case).

A user stylesheet from a chrome content package would be able to load arbitrary
XBL here.

Arguably userContent.css could be special-cased, but there are some serious
security issues involved in that, especially if people are copying and pasting
CSS from random websites into userContent.css, so that hasn't been done.

> 2) If something has changed, is there any doc/reference where the
> expected behaviour is explained (besides the source code, of course)?

Not yet, looks like. I've flagged the relevant bug with a documentation request.

> According to MDC, starting with Firefox3 it should be possible to use
> data: urls for bindings

That's part of the documentation that's out of date (due to the same security
fix). data: URIs can only be used from chrome stylesheets.

-Boris

[esquifit]

I see. Thank you very much for the quick answer!
Regards
e.