1399997 - Remove usage of eval and new Function() in JSM scopes

Status: RESOLVED FIXED

(Core :: XPConnect, enhancement)

Description

[Kris Maglione [:kmag]]

Aside from being a security and performance concern, this poses problems for JSM global sharing.

Comment 1

[Kris Maglione [:kmag]]

Attachment: Bug 1399997: Part 1 - Fix eval usage in Redux.jsm.

Review commit: https://reviewboard.mozilla.org/r/179954/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/179954/

Comment 2

[Kris Maglione [:kmag]]

Attachment: Bug 1399997: Part 2 - Fix eval usage in PhoneNumber.jsm.

Review commit: https://reviewboard.mozilla.org/r/179956/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/179956/

Comment 3

[Kris Maglione [:kmag]]

Attachment: Bug 1399997: Part 3 - Update module environment tests with TODOs for shared module eval bindings.

Review commit: https://reviewboard.mozilla.org/r/179958/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/179958/

Comment 4

[Ted Campbell [:tcampbell]]

Comment on attachment 8908321 [details]
Bug 1399997: Part 3 - Update module environment tests with TODOs for shared module eval bindings.

https://reviewboard.mozilla.org/r/179958/#review185156

Thanks for the cleanup. Making these TODOs makes sense.

Comment 5

[Dave Townsend [:mossop]]

Comment on attachment 8908319 [details]
Bug 1399997: Part 1 - Fix eval usage in Redux.jsm.

https://reviewboard.mozilla.org/r/179954/#review185194

Eww

Comment 6

[Kris Maglione [:kmag]]

Comment on attachment 8908319 [details]
Bug 1399997: Part 1 - Fix eval usage in Redux.jsm.

https://reviewboard.mozilla.org/r/179954/#review185194

Agreed.

Thanks!

Comment 7

[Kris Maglione [:kmag]]

Parts 1 and 3 are enough to unblock bug 1381961, so landing those now. Part 2 will still be needed for bug 1396145.

Comment 8

[Kris Maglione [:kmag]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/81e5e9200b41b827addbecfe34736bfd13249ab9
Bug 1399997: Part 1 - Fix eval usage in Redux.jsm. r=Mossop

https://hg.mozilla.org/integration/mozilla-inbound/rev/216079d767e7fd9351abf09e605ae63c2948bd53
Bug 1399997: Part 3 - Update module environment tests with TODOs for shared module eval bindings. r=tcampbell

Comment 9

[Matthew N. [:MattN]]

Comment on attachment 8908320 [details]
Bug 1399997: Part 2 - Fix eval usage in PhoneNumber.jsm.

https://reviewboard.mozilla.org/r/179956/#review185246

Comment 10

[Kris Maglione [:kmag]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2a05fcf72a3a061d94fdb867c934e8f2c4bd3dde
Bug 1399997: Part 2 - Fix eval usage in PhoneNumber.jsm. r=MattN

Comment 11

[Mark Banner (:standard8)]

NI to activity stream folks, to make sure they seem the part 1 change.

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/81e5e9200b41
https://hg.mozilla.org/mozilla-central/rev/216079d767e7
https://hg.mozilla.org/mozilla-central/rev/2a05fcf72a3a

Comment 13

[[github robot]]

Commit pushed to master at https://github.com/mozilla/activity-stream

https://github.com/mozilla/activity-stream/commit/5a1cb33f0ab5cfd453cef286afa3321381252195
chore(vendor): Backport Bug 1399997 - Remove usage of eval and new Function() in JSM scopes. r=Mossop (#3495)