[Security approval request comment] How easily could an exploit be constructed based on the patch? Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? Which older supported branches are affected by this flaw? If not all supported branches, which bug introduced the flaw? Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? How likely is this patch to cause regressions; how much testing does it need?
Bug 1810705 Comment 27 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
[Security approval request comment] How easily could an exploit be constructed based on the patch? Not easy, the patch added a new third party launch flow but does not show why we are doing it. Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? No, there are nothing in the patch that points to the security problem. Which older supported branches are affected by this flaw? All If not all supported branches, which bug introduced the flaw? N/A Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? No, because this new flow requires new strings, we will have to also backport the string (and it's associated translations). How likely is this patch to cause regressions; how much testing does it need? Low likeliness to cause regression. Lots of unit tests related to this feature and we've been using the same user flow in private tabs for a long time.
[Security approval request comment] How easily could an exploit be constructed based on the patch? Not easy, the patch added a new third party launch flow but does not show why we are doing it. Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem? No, there are nothing in the patch that points to the security problem. Which older supported branches are affected by this flaw? All If not all supported branches, which bug introduced the flaw? N/A Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be? No, because this new flow requires new strings, we will have to also backport the string (and it's associated translations). How likely is this patch to cause regressions; how much testing does it need? Low likeliness to cause regression. Lots of unit tests related to this feature and we've been using the same user flow in private tabs for a long time.