1352513 - Add a pref for the hidden window behaviour bug 1145470 is removing

Status: RESOLVED FIXED

(Core :: Security: CAPS, enhancement)

Description

[:Gijs (out for now; he/him)]

Per discussion on IRC with bholley and Ryan, while we would really like to ship this stuff (and potentially other related fixes that constrain how we do system privileged things), it seems that there might be add-on impact from doing so. As a result, we might have to be able to disable such changes, for which a pref might be useful.

We would likely keep the change from bug 1145470 and similar changes on Nightly and possibly other pre-release branches (depending on impact), to avoid reintroducing code that violates some of the constraints (which, if allowed, would effectively bitrot those constraining efforts, making it harder to turn such constraints on permanently when XPCOM-based add-ons disappear).

Comment 1

[Bill Gianopoulos [:WG9s]]

This sounds like a great plan!

Comment 2

[:Gijs (out for now; he/him)]

Attachment: Bug 1352513 - re-add the hidden window exception behind a pref,

Review commit: https://reviewboard.mozilla.org/r/125944/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/125944/

Comment 3

[:Gijs (out for now; he/him)]

I've deliberately left out any ifdefs to turn this off on beta/release channels, because so far the damage actually seems fairly limited, but if you think it'd be simpler then we could just add ifdefs to disable this on beta/release already.

I've used a pretty generic name because I imagine I'll want to use the same pref for bug 1320124. Keeping the hidden window exception and fixing bug 1320124 will still break the hidden window case, so having just 1 pref seemed the most sensible.

Comment 4

[Bobby Holley (:bholley)]

Comment on attachment 8853925 [details]
Bug 1352513 - re-add the hidden window exception behind a pref,

https://reviewboard.mozilla.org/r/125944/#review128644

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/09ee763947c3
re-add the hidden window exception behind a pref, r=bholley

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/09ee763947c3