Closed Bug 1399997 Opened 5 years ago Closed 5 years ago

Remove usage of eval and new Function() in JSM scopes

Categories

(Core :: XPConnect, enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla57
Tracking Status
firefox57 --- fixed

People

(Reporter: kmag, Assigned: kmag)

References

(Blocks 1 open bug)

Details

Attachments

(3 files)

Aside from being a security and performance concern, this poses problems for JSM global sharing.
Comment on attachment 8908321 [details]
Bug 1399997: Part 3 - Update module environment tests with TODOs for shared module eval bindings.

https://reviewboard.mozilla.org/r/179958/#review185156

Thanks for the cleanup. Making these TODOs makes sense.
Attachment #8908321 - Flags: review?(tcampbell) → review+
Comment on attachment 8908319 [details]
Bug 1399997: Part 1 - Fix eval usage in Redux.jsm.

https://reviewboard.mozilla.org/r/179954/#review185194

Eww
Attachment #8908319 - Flags: review+
Comment on attachment 8908319 [details]
Bug 1399997: Part 1 - Fix eval usage in Redux.jsm.

https://reviewboard.mozilla.org/r/179954/#review185194

Agreed.

Thanks!
Attachment #8908319 - Flags: review?(standard8)
Parts 1 and 3 are enough to unblock bug 1381961, so landing those now. Part 2 will still be needed for bug 1396145.
Keywords: leave-open
https://hg.mozilla.org/integration/mozilla-inbound/rev/81e5e9200b41b827addbecfe34736bfd13249ab9
Bug 1399997: Part 1 - Fix eval usage in Redux.jsm. r=Mossop

https://hg.mozilla.org/integration/mozilla-inbound/rev/216079d767e7fd9351abf09e605ae63c2948bd53
Bug 1399997: Part 3 - Update module environment tests with TODOs for shared module eval bindings. r=tcampbell
Comment on attachment 8908320 [details]
Bug 1399997: Part 2 - Fix eval usage in PhoneNumber.jsm.

https://reviewboard.mozilla.org/r/179956/#review185246
Attachment #8908320 - Flags: review?(MattN+bmo) → review+
Keywords: leave-open
NI to activity stream folks, to make sure they seem the part 1 change.
Flags: needinfo?(edilee)
Flags: needinfo?(dmose)
Flags: needinfo?(edilee)
Flags: needinfo?(dmose)
Commit pushed to master at https://github.com/mozilla/activity-stream

https://github.com/mozilla/activity-stream/commit/5a1cb33f0ab5cfd453cef286afa3321381252195
chore(vendor): Backport Bug 1399997 - Remove usage of eval and new Function() in JSM scopes. r=Mossop (#3495)
See Also: → 1486375
You need to log in before you can comment on or make changes to this bug.