> https://searchfox.org/mozilla-central/rev/0fe159e3c1a09d9cd22b0ceadbe01efc7e8fd788/dom/security/nsContentSecurityUtils.cpp#2242-2248 on the other hand looks worrisome. Why is that before the sandbox check.
We shouldn't even try to check if a download is potentially insecure due to mixed content, we should just block it if the sandbox flags don't allow it.
Currently we also allow downloads triggered by the system principal to bypass the sandbox flags, but not the mixed content blocking. I am not sure if that is really intentional either. It seems backwards to me?
Bug 1971704 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
> https://searchfox.org/mozilla-central/rev/0fe159e3c1a09d9cd22b0ceadbe01efc7e8fd788/dom/security/nsContentSecurityUtils.cpp#2242-2248 on the other hand looks worrisome. Why is that before the sandbox check. bug 1969304 comment 4 We shouldn't even try to check if a download is potentially insecure due to mixed content, we should just block it if the sandbox flags don't allow it. Currently we also allow downloads triggered by the system principal to bypass the sandbox flags, but not the mixed content blocking. I am not sure if that is really intentional either. It seems backwards to me?