Don't allow javascript: favicons. b=290036 r=dveditz sr=brendan a=chase

toolkit/content/widgets/tabbrowser.xml

@@ -751,6 +751,9 @@
             var origURIStr = safeGetProperty(targetDoc, "documentURI");
             var origURI = ioService.newURI(origURIStr, docCharset, null);
 
+            if (uri.schemeIs("javascript"))
+              return;
+
             const nsIScriptSecMan =
               Components.interfaces.nsIScriptSecurityManager;
 

xpfe/global/resources/content/bindings/tabbrowser.xml

@@ -697,6 +697,9 @@
             var origURIStr = safeGetProperty(targetDoc, "documentURI");
             var origURI = ioService.newURI(origURIStr, docCharset, null);
 
+            if (uri.schemeIs("javascript"))
+              return;
+
             const nsIScriptSecMan =
               Components.interfaces.nsIScriptSecurityManager;