1017568 - Don't expose window.dump to web content

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[David Bruant]

I haven't found a standard for it and it's not supported by Chrome.

There *might* be a web-compat issue around bug 972250 (which was fixed by backing out a change to window.dump), but I'm not sure.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Hmm.  We might be able to expose it if chrome or browser.dom.window.dump.enabled is set.  It worries me a bit that we might have code in untrusted bits like debugger or extensions (e.g. Chatzilla) that have dump() calls...

Comment 2

[Boris Zbarsky [:bzbarsky]]

Also, we should decide what workers should do.  This is tougher, since they can't check the pref, right?

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to Boris Zbarsky [:bz] from comment #2)
> Also, we should decide what workers should do.  This is tougher, since they
> can't check the pref, right?

Not really, we have infrastructure for propagating preference changes to workers.  Look at RuntimeService::Init.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Ah, so we could do it with a Func in the IDL, ok.

Comment 5

[(no longer active)]

(In reply to comment #4)
> Ah, so we could do it with a Func in the IDL, ok.

Doesn't [Pref] work for stuff that is exposed to workers?

Comment 6

[Boris Zbarsky [:bzbarsky]]

It will pass codegen and output code that touches the preference service from the worker thread.  So it not only doesn't work, it outputs bogus code.  :(

Comment 7

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.