The Burning Edge

Firefox 1.0.4 has been released. I think it's the same as the candidates in the previous post.

These are release candidates for Firefox 1.0.4. If you've been following Asa's blog, these candidates are the ones he calls final (hopefully) 1.0.4 candidates. I hadn't posted earlier candidates because they didn't contain fixes for all of the blocking security holes.

There is a post about these builds on Asa's blog. If you think you've found a regression, please report it using IRC or post a comment on Asa's blog entry. If no problems come up, these builds will become Firefox 1.0.4 tonight (PDT).

Please help test these builds. Trunk doesn't have all the security fixes, and testing 1.0.4 candidates should be more fun than disabling JavaScript or only visiting sites you trust. If you've been using trunk, be sure to install this build into a different directory, because installing 1.0.x on top of trunk can cause problems. I don't know whether you'll need to create a new profile.

Security fixes in Firefox 1.0.4:

• Fixed: 292691#c5 - XSS security hole involving frames and javascript: URLs. Regression in Firefox 1.0.3.
• Fixed: 292691#c14 - Sites whitelisted for extension installation can execute arbitrary code by abusing a security hole in the extension-installation dialog. Regression in Firefox 1.0.3. Firefox only (not in Mozilla suite).
• Fixed: 290949 - <link> tag still allows to execute arbitrary code without user interaction (variant of 290036, which was fixed in Firefox 1.0.3).
• Fixed: 290908 - (Security hole involving new Script(). Regression in Firefox 1.0.3.)
• Fixed: 290982 - (Security hole involving jar:, view-source: protocols)
• Fixed: 293671 - (Security hole involving nested jar:, view-source: protocols)

All other fixes in Firefox 1.0.4:

• Fixed: 290777 - Regression in defining getters on prototypes in content script. (aka The Firefox 1.0.3 DHTML regression.)
• Fixed: 290476 - js_AllocStack doesn't clear space it returns.
• Fixed: 280137 - [OS/2] Get rid of PMWINX dependency.
• Fixed: 272369 - [S390] firefox -register results in SIGSEGV.
• Fixed: 264324 - [S390] Incorrect defines in s390/s390x.

Official Windows, Official Windows installer

Official Linux, Official Linux installer

Official Mac

There have been no changes since the previous Burning Edge post (2004-11-07 branch builds). Firefox 1.0 is the same file as that build, at least for the Windows English zip build (I checked using md5sum).

There is one surprise: Firefox's default home page now redirects to a co-branded version of the Google homepage. Mitchell explains:

In keeping with our emphasis on the end-user, we have redesigned the Firefox startpage. We wanted a startpage that reflected the Mozilla project and provided a good access point to the web. Given the importance of search, we decided to add search functionality to the start page itself. Google has long been recognized as a leader in search experience and so we chose Google.

All builds and source

Release notes, Unofficial changelog

mozillaZine article, MozillaNews article, Ben's blog post, Blake's blog post, Mitchell's blog post