1491759 - Remove eval from loadPrivilegedScript() in specialpowersAPI.js

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P2)

Description

[Vinothkumar Nagasayanan [:vinoth]]

As part of Bug 1473549, we are in the process of adding an assertion to make sure that eval() is not executed with system principal.

Eval() has been used in loadPrivilegedScript() in specialpowersAPI.js, We need to remove this eval() and replace it with someother alternative.

Comment 1

[Vinothkumar Nagasayanan [:vinoth]]

Hi,

Please see comment 1, It seems that this eval() (https://dxr.mozilla.org/mozilla-central/rev/7ed950e60f3c1f8a47c117c04124d31e94a66e32/testing/specialpowers/content/specialpowersAPI.js#520) is added as part of Bug 1260076 by you and please take a look at. 
Apparently we need to remove this eval from that function.
Let me know you comments.

Comment 2

[Junior [inactive]]

AFAICT The goal is to load the chrome privileged script in the content process for testing, basically for Presentation API.
I don't have a good idea how to replace it.
If it's too hard and asserting |eval()| matters, you can disable the relative tests.

Comment 3

[Vinothkumar Nagasayanan [:vinoth]]

Attachment: Bug 1491759 - Replaced eval with loadSubScript from loadPrivilegedScript() in specialpowersAPI.js

Comment 4

[Vinothkumar Nagasayanan [:vinoth]]

Comment on attachment 9015183 [details]
Bug 1491759 - Replaced eval with loadSubScript from loadPrivilegedScript() in specialpowersAPI.js

I have replaced eval() with loadsubscript().
Please kindly review the patch and let me know if changes are needed.

Try server push for this change is,
https://treeherder.mozilla.org/#/jobs?repo=try&revision=eb7603d26895cd46f58bca4ae69fb4c291d6f37c

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/1bae9022b97e
Replaced eval with loadSubScript from loadPrivilegedScript() in specialpowersAPI.js r=JuniorHsu

Comment 6

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/1bae9022b97e