1058921 - Disable unsafe Window APIs in prerendering

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Roshan Vidyashankar [:rvid]]

close, focus, open, alert, confirm, prompt, print, showModalDialog, moveTo, moveBy, resizeTo, resizeBy, back, forward, home, maximize, minimize, restore, sizeToContent, fullscreen, find

Comment 1

[Roshan Vidyashankar [:rvid]]

Attachment: 1058921.patch

Comment 2

[Johnny Stenback (:jst)]

Comment on attachment 8483800 [details] [diff] [review]
1058921.patch

These changes all look good, but we should also flag innerWidth, innerHeight, outerWidth, outerHeight. Though for those we probably only want to flag the setters... do we have support for that already?

r- to deal with those additional properties.

Comment 3

[Johnny Stenback (:jst)]

Oh, forgot to mention that those properties are disabled by default, but can be enabled per site, so we may want to do the checking in the implementation of those rather than using webidl annotations.

Comment 4

[(no longer active)]

I filed bug 1117876 as a follow-up to this to blacklist those setters as well.  We probably want to do that in the implementation which is why I'm breaking that up into its own bug.

https://hg.mozilla.org/integration/mozilla-inbound/rev/c7fdb9bfb672

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/c7fdb9bfb672