1205448 - Ship subresource integrity enabled by default

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[François Marier [:francois]]

Intent to ship: https://groups.google.com/d/msg/mozilla.dev.platform/3_d1JIxsIJc/IObUw7zOMQAJ

Comment 1

[François Marier [:francois]]

Attachment: MozReview Request: Bug 1205448 - Ship subresource integrity enabled by default. r=ckerschb

Bug 1205448 - Ship subresource integrity enabled by default. r?ckerschb

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8662097 [details]
MozReview Request: Bug 1205448 - Ship subresource integrity enabled by default. r=ckerschb

https://reviewboard.mozilla.org/r/19499/#review17475

::: modules/libpref/init/all.js:1967
(Diff revision 1)
> -pref("security.sri.enable", false);
> +pref("security.sri.enable", true);

Hurray - looks good to me!

Comment 3

[François Marier [:francois]]

Release Note Request (optional, but appreciated)
[Why is this notable]: New web platform feature for developers
[Suggested wording]: Support for subresource integrity
[Links (documentation, blog post, etc)]: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

Note: this has not yet landed, but it should land today or tomorrow.

Comment 4

[François Marier [:francois]]

Comment on attachment 8662097 [details]
MozReview Request: Bug 1205448 - Ship subresource integrity enabled by default. r=ckerschb

Bug 1205448 - Ship subresource integrity enabled by default. r=ckerschb

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

https://reviewboard.mozilla.org/r/19499/#review17627

::: testing/web-platform/meta/subresource-integrity/subresource-integrity.html.ini:2
(Diff revision 2)
>    type: testharness

sweet - fixing web platform tests!

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5ff4c724c6b7

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5ff4c724c6b7

Comment 8

[Liz Henry (:lizzard) (relman/hg->git project)]

Added to release notes with this wording and the link to MDN: 
Subresource integrity allows developers to make their sites more secure

Comment 9

[François Marier [:francois]]

Jean-Yves: there's https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity on MDN and I filed bug 1206220 with some comments.

Comment 10

[Jean-Yves Perrier [:teoli]]

Yep, it will be to update the compat data on this page when it is enabled by default.

Comment 11

[Jean-Yves Perrier [:teoli]]

I double checked the release version indicated in the different doc pages and it is the correct one :-)

Comment 12

[Liz Henry (:lizzard) (relman/hg->git project)]

I noted this a while back for 43, but also now have a note for bug 992096. Are these really the same thing?

Comment 13

[François Marier [:francois]]

> I noted this a while back for 43, but also now have a note for bug 992096. Are these really the same thing?

Yes, they're the same thing. bug 992096 was to implement it pref'ed OFF and this bug was to pref it ON by default. Both landed in 43.