Toggle the pref to disable @-moz-document in content pages on release

RESOLVED FIXED in Firefox 61

Status

()

enhancement
P3
normal
RESOLVED FIXED
a year ago
10 months ago

People

(Reporter: emilio, Assigned: tjr)

Tracking

(Blocks 2 bugs, {dev-doc-complete, sec-want, site-compat})

unspecified
mozilla61
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox61 fixed)

Details

(Whiteboard: [adv-main61-])

Attachments

(1 attachment)

+++ This bug was initially created as a clone of Bug #1035091 +++

Bug 1035091 landed the code on early Beta and Nightly. We should switch the pref in this one.
Priority: -- → P1
Priority: P1 → P3
Comment hidden (mozreview-request)
(Reporter)

Comment 2

a year ago
mozreview-review
Comment on attachment 8959997 [details]
Bug 1422245 Disable @-moz-document in content pages

https://reviewboard.mozilla.org/r/228778/#review234480

Hah, so... This is fine I suppose.

There's still some breakage from it (most notably Youtube comments, bug 1426068), and all of them were using `@-moz-document url-prefix()` for that, so I think we should still parse it on content pages.

Curiously I filed bug 1446470 on that 2 days ago, and that includes this patch. Let's land this for now, I'll rebase my patches on top. Maybe mention that bug on the commit message?

Thanks!
Attachment #8959997 - Flags: review?(emilio) → review+
(Reporter)

Comment 3

a year ago
(Or we can land this after those patches, and I'll remove part 3 on that bug, your call).
(Assignee)

Updated

a year ago
Assignee: nobody → tom
Comment hidden (mozreview-request)
(Assignee)

Updated

a year ago
Keywords: checkin-needed
(Reporter)

Comment 6

a year ago
(In reply to Kohei Yoshino [:kohei] from comment #5)
> Posted the site compatibility note:
> https://www.fxsitecompat.com/en-CA/docs/2018/moz-document-has-been-dropped/

Beware of bug 1446470, which will fix all the known breakages so far too, and is intended to land in time for the same firefox release.

That bug means that @-moz-document url-prefix() { } will keep working.
Flags: needinfo?(kohei.yoshino)
So no security issues will be solved here? This bug can be simply WONTFIXed then... :(
Flags: needinfo?(kohei.yoshino)
(Reporter)

Comment 8

a year ago
Wait, what? Yes. The security issue is with other url matching functions, like regex(..), which this patch forbids. We'll just allow an empty url-prefix to avoid breaking websites.
Thanks for the clarification. Updating the note accordingly.

Comment 10

a year ago
Pushed by rgurzau@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a83ccbf8a6b6
Disable @-moz-document in content pages r=emilio
Keywords: checkin-needed
(In reply to Emilio Cobos Álvarez [:emilio] from comment #6)
> (In reply to Kohei Yoshino [:kohei] from comment #5)
> > Posted the site compatibility note:
> > https://www.fxsitecompat.com/en-CA/docs/2018/moz-document-has-been-dropped/
> 
> Beware of bug 1446470, which will fix all the known breakages so far too,
> and is intended to land in time for the same firefox release.
> 
> That bug means that @-moz-document url-prefix() { } will keep working.

We should probably post an update to the Intent to unship thread in dev-platform about this plan as well.

Comment 12

a year ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/a83ccbf8a6b6
Status: NEW → RESOLVED
Last Resolved: a year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
I've updated the compat data to capture this: https://developer.mozilla.org/en-US/docs/Web/CSS/@document#Browser_compatibility

Marking dev-doc-complete, but please comment if we need anything else.
(In reply to Will Bamberg [:wbamberg] from comment #13)
> I've updated the compat data to capture this:
> https://developer.mozilla.org/en-US/docs/Web/CSS/
> @document#Browser_compatibility
> 
> Marking dev-doc-complete, but please comment if we need anything else.

I also added a rel note:

https://developer.mozilla.org/en-US/Firefox/Releases/61#CSS
Whiteboard: [adv-main61-]
You need to log in before you can comment on or make changes to this bug.