1275612 - [meta] Don't allow any origins to send objects over WebChannel

Status: RESOLVED FIXED

(Toolkit :: General, task, P3)

Description

[Thom Chiovoloni [:tcsc] (ex-moco)]

In bug 1238128, several origins were whitelisted as allowed to send objects through webchannels (all other origins should be sending strings). This is not ideal, but is required for backwards compatibility.

This bug tracks the work related to removing entries from the whitelist and eventually removing the special-cased code all together.

Comment 1

[Luca Greco [:rpl] [:luca] [:lgreco]]

Hey Mark, all bugs tracked by this meta seems to be closed, can this also be closed?

Comment 2

[Mark Hammond [:markh] [:mhammond]]

Opened 3 more bugs which are required to finally remove this preference and capability.

Comment 3

[Andrew McCreight [:mccr8]]

There are only two URLs in the list now, https://content.cdn.mozilla.net and https://install.mozilla.org. As I rambled about a bit in bug 1786654, I can find no evidence that these sites exist any more, nor that they are used for WebChannels in any kind of way. Although I could not find any evidence that they were ever used so maybe I'm overlooking something. They don't even have DNS entries, so I think we can remove this entire mechanism.

Comment 4

[Andrew McCreight [:mccr8]]

I've been spending far too long staring at this code so I can put a patch together early next week, most likely.

Comment 5

[Andrew McCreight [:mccr8]]

Attachment: Bug 1275612 - Don't allow any origins to send objects over WebChannel.

Comment 7

[Andrew McCreight [:mccr8]]

My patch changes two tests using weird objects instead of a string for the contentData property of the WebChannelMessageToChrome, simplifying the typing of this message.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/eb90f648ee67
Don't allow any origins to send objects over WebChannel. r=Gijs

Comment 9

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/eb90f648ee67