Bugzilla

(In reply to Andrew McCreight [:mccr8] from comment #11)
> This should not have landed without sec-approval, or a security rating below sec-high.
> 
> I guess I'll rate it sec-moderate now, because it sounds like it requires user interaction, and a rather obscure one at that: "it would only happen if you're sharing to the reminder service".

My apologies, this was my mistake. I was going through a series of bugs/patches that were waiting to be landed earlier today and unfortunately, this was one of them. I did review the landing requirements for security bugs and saw that sec-low and sec-moderate bugs could be landed without sec-approval. Having reviewed the patch I inferred the same as Josh mentioned in comment 12, but since this was not explicit in the bug, I should not have landed the patch anyway. I did remove the reference to UAF from the commit message before landing.

.