Closed Bug 1254823 Opened 8 years ago Closed 4 years ago

noisolation should be default for <iframe mozbrowser> on desktop

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

RESOLVED INVALID

People

(Reporter: jryans, Unassigned)

References

Details

(Whiteboard: btpp-backlog)

On dev-platform, :sicking suggests:

"Make <iframe mozbrowser> act as if 'noisolation' is set when the
element is used in chrome documents (documents with a system
principal)."

This is simple to do for the desktop case at least.  There are some B2G specific code paths[1] related to apps that will need some additional work before this could be true on all platforms, so I am not sure we would want to pursue that portion here.

[1]: https://dxr.mozilla.org/mozilla-central/rev/05c087337043dd8e71cc27bdb5b9d55fd00aaa26/dom/base/nsFrameLoader.cpp#1640-1647
I suggest we use #ifdef MOZ_WIDGET_GONK for now to handle the B2G specific behavior, if needed.

However I think that the only <iframe mozbrowser> that is used by chrome code in B2G in shell.html which uses <iframe mozbrowser mozapp>. I think it's fine to use isolation when mozapp is also set since that more or less explicitly asks for isolation.

So my proposal is to default to no isolation only when <iframe mozbrowser> appears in a page with chrome privileges and when no mozapp attribute is set.
Kanru, are you still Mr. mozbrowser?
Flags: needinfo?(kchen)
Whiteboard: btpp-followup-2016-04-07
(In reply to Andrew Overholt [:overholt] from comment #2)
> Kanru, are you still Mr. mozbrowser?

I can review patches if someone wrote them but I'll have less time to implement this and test them. It doesn't seem very urgent though.
Flags: needinfo?(kchen)
Whiteboard: btpp-followup-2016-04-07 → btpp-backlog
Assignee: nobody → allstars.chh
Assignee: allstars.chh → nobody
Priority: -- → P3
Component: DOM → DOM: Core & HTML

mozbrowser is gone.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.