Improve security by limiting injection scope

[greasemonkey]

See list posts:
http://groups.google.com/group/greasemonkey-users/msg/89adb81c9be5544a
http://groups.google.com/group/greasemonkey-users/msg/784f75d135ba410a

By allowing injection into file: URLs, arbitrary files whose paths are known can be stolen and transmitted to any server by malicious scripts. By allowing injection into about:cache, the location of the user profile can be discovered, making this flaw much more serious.

Do not allow scripts to run at file: or about: URLs. Since this has the very real potential (near guarantee) of causing backwards compatibility issues, a hidden default-off preference should be set up to override this, so that concerned users can override its value via about:config and restore the old behavior.

[arantius]

See also: http://greasemonkey.devjavu.com/ticket/110

Greasing the data: scheme can be useful.

[arantius]

Integrated into official tree.

[Martii]

Reference: commit.