rem: var safeurls = /(^http(s)?:|^file:|^chrome:|^resource:|^mailbox:|^imap:|^(s)?news:|^nntp:|^about:|^mailto:|^ftp:|^gopher:)/i; if (url.search(safeurls) == 0) { 
add: var safeurls = /^https?:|^file:|^chrome:|^resource:|^mailbox:|^imap:|^s?news:|^nntp:|^about:|^mailto:|^ftp:|^gopher:/i; if (safeurls.test(url)) { 
context: function openLink(node){    var url = node.getAttribute("value");    // Security-Critical: Only links to 'safe' protocols should be functional.    // Specifically, javascript: and data: URLs must be made non-functional    // here, because they will run with full privilege.    var safeurls = /(^http(s)?:|^file:|^chrome:|^resource:|^mailbox:|^imap:|^(s)?news:|^nntp:|^about:|^mailto:|^ftp:|^gopher:)/i;    if (url.search(safeurls) == 0) {        var secMan = Components.classes["@mozilla.org/scriptsecuritymanager;1"].getService().                         QueryInterface(nsIScriptSecurityManager);        try {            secMan.checkLoadURIStr(nodeView._content.document.location,                                   url, nsIScriptSecurityManager.STANDARD);        } catch (e) {            return;        }        nodeView._content.document.location = url;        window.close();    }}
meta: 9421	/local1/tlutelli/issta_data/temp/all_js/javascript/2006_temp/2006/9421/27693d2d30ec867932f997e2aacdff13c90d82f5/metadata.js/buggy/suite/browser/metadata.js