ssl written iframes are affected by about:blank permissions

[al_9x]

A written iframe takes on the URL of the parent and should be allowed if the parent is allowed, and should not be affected by about:blank permissions.

NS 2.0.9.4rc1, Fx 3.6.13, new profile, remove (msn.com, about:blank) from the whitelist.

1. login to https hotmail: https://mail.live.com/
2. once you get to the inbox, you'll see that the two ad iframes (1 - lower left, 2 - right column) are untrusted. They both have the url of their parent (InboxLight.aspx), which is trusted.
3. add about:blank back to the whitelist and refresh, the iframes now appear to be trusted

[Giorgio Maone]

Investigating, thanks.

[al_9x]

Another example of this is on the Amazon homepage. The dynamically added (via DOM it seems) iframe should be allowed, since amazon.com is, but isn't when about:blank is not whitelisted.

This started in 2.0.9.2. Can you repro?

[al_9x]

fixed in a latter build