1284202 - Add deprecation warning for SEC_NORMAL

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Christoph Kerschbaumer [:ckerschb}]

We should not use SEC_NORMAL within the loadInfo anymore, we should use one of the following 5 flags:

SEC_REQUIRE_SAME_ORIGIN_DATA_INHERITS
SEC_REQUIRE_SAME_ORIGIN_DATA_IS_BLOCKED
SEC_ALLOW_CROSS_ORIGIN_DATA_INHERITS
SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL
SEC_REQUIRE_CORS_DATA_INHERITS

Comment 1

[Christoph Kerschbaumer [:ckerschb}]

Attachment: bug_1284202_deprecation_warning_sec_normal.patch

Comment 2

[Tanvi Vyas[:tanvi]]

Comment on attachment 8767591 [details] [diff] [review]
bug_1284202_deprecation_warning_sec_normal.patch

r+ but we can't land this yet because of http://searchfox.org/mozilla-central/source/docshell/base/nsDocShell.cpp#10790

Comment 3

[Christoph Kerschbaumer [:ckerschb}]

(In reply to Tanvi Vyas - behind on reviews [:tanvi] from comment #2)
> Comment on attachment 8767591 [details] [diff] [review]
> bug_1284202_deprecation_warning_sec_normal.patch
> 
> r+ but we can't land this yet because of
> http://searchfox.org/mozilla-central/source/docshell/base/nsDocShell.
> cpp#10790

I think we can, I just don't want anyone creating a new channel (loadinfo) using this flag anymore.
Thanks Tanvi!

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/d7cddb7c5b31
Add deprecation warning for SEC_NORMAL. r=tanvi

Comment 5

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/d7cddb7c5b31

Comment 6

[Tanvi Vyas[:tanvi]]

Ah right, this just adds a comment.  Thanks Chris!