1346072 - Remove accounts.firefox.com from the whitelist of domains allowed to send objects over webchannels.

Status: RESOLVED FIXED

(Firefox :: Firefox Accounts, enhancement, P3)

Description

[Mark Hammond [:markh] [:mhammond]]

In bug 1275616, Firefox accounts no longer sends objects over web channels. This means we can remove this server from the whitelist maintained in Firefox for servers allowed to send objects.

I believe the work here is:

* change the |webchannel.allowObject.urlWhitelist| preference's default value to no longer include accounts.firefox.com

* change services/fxaccounts/FxAccountsConfig.jsm to no longer attempt to maintain that preference value.

* test that all browser interaction with that domain continues to work correctly.

This might well be a "good second bug", so adding myself as mentor (but not marking as good-first-bug, as that's probably a stretch).

Comment 1

[Ryan Leake]

Hi Mark! I'd like to take this bug on. Looking at FxAccountsConfig.jsm I'm unsure what changes are required, any tips?

Comment 2

[Mark Hammond [:markh] [:mhammond]]

The line at https://searchfox.org/mozilla-central/rev/33c90c196bc405e628bc868a4f4ba29b992478c0/browser/app/profile/firefox.js#1673 needs to have "https://accounts.firefox.com " removed and the lines at https://searchfox.org/mozilla-central/rev/33c90c196bc405e628bc868a4f4ba29b992478c0/services/fxaccounts/FxAccountsConfig.jsm#71-86, plus those at https://searchfox.org/mozilla-central/rev/33c90c196bc405e628bc868a4f4ba29b992478c0/services/fxaccounts/FxAccountsConfig.jsm#166-170, can all be deleted entirely. Then all the tests need to be run (possibly via the try server) we should be good to go!

Comment 3

[Ryan Leake]

Thanks Mark! I've made the changes to the code, can you tell me more about the required tests (I'm unfamiliar with the try server)?

Comment 4

[Mark Hammond [:markh] [:mhammond]]

Thanks for contributing!

If you put a patch up following the instructions at https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/How_to_Submit_a_Patch, I'm happy to help running it though the try server. If you are able to push it via mozreview, then it will be trivial and you can probably do it yourself, but even if you just attach a patch directly to bugzilla I'll help with the next steps.

Thanks!

Comment 5

[Ryan Leake]

Attachment: Bug 1346072 - Remove accounts.firefox.com from the whitelist of domains allowed to send objects over webchannels.

Review commit: https://reviewboard.mozilla.org/r/202906/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/202906/

Comment 6

[Mark Hammond [:markh] [:mhammond]]

Comment on attachment 8931777 [details]
Bug 1346072 - Remove accounts.firefox.com from the whitelist of domains allowed to send objects over webchannels.

https://reviewboard.mozilla.org/r/202906/#review208374

Looks great, thanks! Can you please fixup the trivial whitespace issue and push a new version, then I'll r+ and land it (assuming the try push looks good)

::: services/fxaccounts/FxAccountsConfig.jsm:70
(Diff revision 1)
>      // will have initialized, which will leave them pointing at production.
>      for (let pref of CONFIG_PREFS) {
>        Services.prefs.clearUserPref(pref);
>      }
>      // Reset the webchannel.
> -    EnsureFxAccountsWebChannel();
> +    EnsureFxAccountsWebChannel();  

it looks like you accidentally introduced whitespace at the end of this line.

Comment 7

[Ryan Leake]

Comment on attachment 8931777 [details]
Bug 1346072 - Remove accounts.firefox.com from the whitelist of domains allowed to send objects over webchannels.

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/202906/diff/1-2/

Comment 8

[Mark Hammond [:markh] [:mhammond]]

Comment on attachment 8931777 [details]
Bug 1346072 - Remove accounts.firefox.com from the whitelist of domains allowed to send objects over webchannels.

https://reviewboard.mozilla.org/r/202906/#review208468

Awesome, thanks!

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/db88252d490f
Remove accounts.firefox.com from the whitelist of domains allowed to send objects over webchannels. r=markh

Comment 10

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/db88252d490f