1225383 - Uplift Meta CSP to Aurora44

Status: RESOLVED WONTFIX

(Core :: DOM: Security, defect)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_part1_csp_parser_changes.patch

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_part2_principal_changes.patch

Comment 3

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_part3_upgrade_insecure_requests_changes.patch

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_part4_speculative_parser_changes.patch

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_part5_htmlmetaelement_changes.patch

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_part6_csp_preloads_changes.patch

Comment 7

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_part7_preload_validation.patch

Comment 8

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_test1.patch

Comment 9

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_test2.patch

Comment 10

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_test3.patch

Comment 11

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_test4.patch

Comment 12

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_test5.patch

Comment 13

[Christoph Kerschbaumer [:ckerschb]]

Attachment: metacsp_test6.patch

Comment 14

[Christoph Kerschbaumer [:ckerschb]]

Hey Steve, as discussed I rebased the patches. It's in your hands from now :-)

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3eef7b25cb11

Comment 15

[Steve Workman [:sworkman] (INACTIVE)]

Chris, could you roll these up into one patch please? It'll be easier to ask for aurora-approval with a single patch.

Comment 16

[Steve Workman [:sworkman] (INACTIVE)]

Pausing on this uplift. Looks like we probably don't need it for hosted new tab for 44. Will attempt to land a hardcoded CSP instead for Fx44.

Comment 17

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Steve Workman [:sworkman] (please use needinfo) from comment #16)
> Pausing on this uplift. Looks like we probably don't need it for hosted new
> tab for 44. Will attempt to land a hardcoded CSP instead for Fx44.

So, after our discussion today, uplifting Meta CSP is really off the table for now.