1332310 - Update TriggeringPrincipal when adding to session history within docshell

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P1)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1332310_add_triggeringprincipal_when_adding_session_history.patch

Boris, it seems that Bug 1307736 is a little more complicated than we thought and will require more work. Tanvi requested tracking for 53 [1]. In particular she is worried about the triggeringPrincipal fallback within docshell and hence she wants to update at least the triggeringPrincipal part when adding to session history [2] (which makes sense to me).

If you agree, then we land this bug now and clear the tracking-requested for 53 from Bug 1307736. Agreed?

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1307736#c11
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1307736#c33

Comment 2

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8828359 [details] [diff] [review]
bug_1332310_add_triggeringprincipal_when_adding_session_history.patch

r=me as far as it goes, but why can't we also land the changes to nsDocShell::CreateContentViewer?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Oh, and this needs a much better commit message.  We're only changing the AddState case, not general session history addition.

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Boris Zbarsky [:bz] (still a bit busy) from comment #2)
> Comment on attachment 8828359 [details] [diff] [review]
> bug_1332310_add_triggeringprincipal_when_adding_session_history.patch
> 
> r=me as far as it goes, but why can't we also land the changes to
> nsDocShell::CreateContentViewer?

Yes, we can land those with this bug too - thanks.

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

[Tracking Requested - why for this release]:
This Bug is a partial fix for Bug 1307736 and why Tanvi requested tracking for 53 [1]. We will land this bug and I will clear the tracking flags for Bug 1307736 as agreed with bz and tanvi.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1307736#c33

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9396973616a5
Update AddState and CreateContentViewer to provide an accurate triggeringPrincipal for creating a history entry. r=bz

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9396973616a5