After a bunch of conversation with Ryan and Freddy, decided to land this (without landing the tests right now) because the bug only affects non-release channels, deducing a working exploit from just the patch is pretty difficult, and there are in fact a number of unrelated changes in the patch (different rng for the part file random bits, different base64 encoding as well) that would make it more difficult for a would-be commit reader to take advantage. Beta 97 channel will have a fix for this issue sometime in the next 24-48-ish hours once the patch in bug 1753096 lands, and earlier branches are not affected. Landing now seemed preferable to waiting until after soft freeze and then uplifting. I'll file a follow-up to land the tests once the 98 branch has hit release, and move the commit over.
Bug 1752996 Comment 3 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
After a bunch of conversation with Ryan and Freddy, decided to land this (without landing the tests right now) because the bug only affects non-release channels, deducing a working exploit from just the patch is pretty difficult, and there are in fact a number of unrelated changes in the patch (different rng for the part file random bits, different base64 encoding as well) that would make it more difficult for a would-be commit reader to take advantage. Beta 97 channel will have a fix for this issue sometime in the next 24-48-ish hours once the patch in bug 1753096 lands, and earlier branches are not affected. Landing now seemed preferable to waiting until after soft freeze and then uplifting. I'll file a follow-up to land the tests once the 98 branch has hit release, and move the commit over. Autoland link: https://hg.mozilla.org/integration/autoland/rev/a384c409bd44bb96f02d51a1503de30b59a95dd4