1210293 - HTMLInputElement::SetUserInput shouldn't check IsCallerChrome

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bobby Holley (:bholley)]

It's only accessible over XPIDL.

Comment 1

[Bobby Holley (:bholley)]

See https://crash-stats.mozilla.com/report/index/01e16a7e-0634-4629-809d-fd7d22150927 and similar

Comment 2

[Bobby Holley (:bholley)]

Attachment: Remove legacy check from the XPIDL HTMLInputElement::SetUserInput. v1

Comment 3

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8668271 [details] [diff] [review]
Remove legacy check from the XPIDL HTMLInputElement::SetUserInput. v1

r=me, but it seems to me like we should make nsIDOMNSEditableElement a non-scriptable interface too.  Looks to me like this mostly means removing a bunch of (already silly) QIs from our tests, but also from a few actual code pieces.

For now, though, at least mark the methods/attributes on the interface noscript, so it's clear that they're not called from script?

Comment 4

[Bobby Holley (:bholley)]

(In reply to Boris Zbarsky [:bz] from comment #3)
> Comment on attachment 8668271 [details] [diff] [review]
> Remove legacy check from the XPIDL HTMLInputElement::SetUserInput. v1
> 
> r=me, but it seems to me like we should make nsIDOMNSEditableElement a
> non-scriptable interface too.

It seems like that might break addons, right? But regardless, this all seems pretty orthogonal to the change being made. It's perfectly fine for these things be called from chrome script over XPIDL, and content script will never see the XPIDL interface, unless there's some risk here I'm missing. Can you explain?

Comment 5

[Boris Zbarsky [:bzbarsky]]

> It seems like that might break addons, right?

Yeah, looks like it would.  OK, then.

> But regardless, this all seems pretty orthogonal to the change being made.

I think the [noscript] is not: it's making it clear that the method is never called from script.

> It's perfectly fine for these things be called from chrome script over XPIDL

It's not possible for that to happen, because we never create XPCWN for these objects.  The noscript on the method will just make that clear to everyone.

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/da07fd36ebb2

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/da07fd36ebb2