bugzilla.mozilla.org has resumed normal operation. Attachments prior to 2014 will be unavailable for a few days. This is tracked in Bug 1475801.
Please report any other irregularities here.

about:addons loads remote web content in the parent process

NEW
Unassigned

Status

()

Toolkit
Add-ons Manager
a year ago
a year ago

People

(Reporter: pauljt, Unassigned)

Tracking

(Blocks: 2 bugs)

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: triaged)

MozReview Requests

()

Submitter Diff Changes Open Issues Last Updated
Loading...
Error loading review requests:

Attachments

(1 attachment, 1 obsolete attachment)

Loading remote web content in the parent process is dangerous in a post-sandbox world, as it means loading remote content outside the sandbox. About:addons loads remote content, mainly from our own sites, but also remote sites like google analytics. From what i have seen so far, all connections seem to be SSL, so that it a mitigating factor, but we should consider moving this to a content process (either existing or new).

PS Couldn't find a more specific component, please move as appropriate.
Blocks: 1305331
Component: General → DOM: Content Processes
Product: Firefox → Core

Comment 1

a year ago
This should be fairly trivial, ie setting remote=true on the <browser> we use to frame the discovery pane. Dave, do you or Andrew have cycles for this?
Component: DOM: Content Processes → Add-ons Manager
Flags: needinfo?(dtownsend)
Product: Core → Toolkit
I seem to recall that it isn't quite that simple but I'll take a look and see what the state is.
Assignee: nobody → dtownsend
Flags: needinfo?(dtownsend)

Comment 3

a year ago
Mossop and I discussed a Gecko bug that he was hitting about this today.  I'll file it tomorrow.
Flags: needinfo?(ehsan)

Updated

a year ago
Depends on: 1340747

Comment 4

a year ago
Mossop, can you please post a WIP patch here that demonstrates the exception we were debugging on IRC yesterday?  Thanks!
Flags: needinfo?(ehsan) → needinfo?(dtownsend)
Created attachment 8839578 [details] [diff] [review]
WIP patch

This is the WIP, really only the change to extensions.xul is necessary and the exception happens when you open the add-ons manager UI.
Flags: needinfo?(dtownsend)
For the gecko bug here.
Flags: needinfo?(ehsan)

Comment 7

a year ago
(In reply to Dave Townsend [:mossop] from comment #6)
> For the gecko bug here.

Not sure which patch you are asking for.  The fix will be in bug 1340747.
Flags: needinfo?(ehsan)

Comment 8

a year ago
Dave, Michael posted a patch in bug 1340747 which I just r+ed.  That should unblock you here.  Let me know if you run into any other issues.

Updated

a year ago
Whiteboard: triaged
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)
Comment hidden (mozreview-request)
Blocks: 1344053
Attachment #8839578 - Attachment is obsolete: true
Comment hidden (mozreview-request)
I'm not actively working on this.
Assignee: dtownsend → nobody
You need to log in before you can comment on or make changes to this bug.