Closed Bug 1422245 Opened 7 years ago Closed 6 years ago

Toggle the pref to disable @-moz-document in content pages on release

Categories

(Core :: CSS Parsing and Computation, enhancement, P3)

enhancement

Tracking

()

RESOLVED FIXED
mozilla61
Tracking Status
firefox61 --- fixed

People

(Reporter: emilio, Assigned: tjr)

References

(Blocks 2 open bugs)

Details

(Keywords: dev-doc-complete, sec-want, site-compat, Whiteboard: [adv-main61-])

Attachments

(1 file)

+++ This bug was initially created as a clone of Bug #1035091 +++

Bug 1035091 landed the code on early Beta and Nightly. We should switch the pref in this one.
Priority: -- → P1
Priority: P1 → P3
Comment on attachment 8959997 [details]
Bug 1422245 Disable @-moz-document in content pages

https://reviewboard.mozilla.org/r/228778/#review234480

Hah, so... This is fine I suppose.

There's still some breakage from it (most notably Youtube comments, bug 1426068), and all of them were using `@-moz-document url-prefix()` for that, so I think we should still parse it on content pages.

Curiously I filed bug 1446470 on that 2 days ago, and that includes this patch. Let's land this for now, I'll rebase my patches on top. Maybe mention that bug on the commit message?

Thanks!
Attachment #8959997 - Flags: review?(emilio) → review+
(Or we can land this after those patches, and I'll remove part 3 on that bug, your call).
Assignee: nobody → tom
Keywords: checkin-needed
(In reply to Kohei Yoshino [:kohei] from comment #5)
> Posted the site compatibility note:
> https://www.fxsitecompat.com/en-CA/docs/2018/moz-document-has-been-dropped/

Beware of bug 1446470, which will fix all the known breakages so far too, and is intended to land in time for the same firefox release.

That bug means that @-moz-document url-prefix() { } will keep working.
Flags: needinfo?(kohei.yoshino)
So no security issues will be solved here? This bug can be simply WONTFIXed then... :(
Flags: needinfo?(kohei.yoshino)
Wait, what? Yes. The security issue is with other url matching functions, like regex(..), which this patch forbids. We'll just allow an empty url-prefix to avoid breaking websites.
Thanks for the clarification. Updating the note accordingly.
Pushed by rgurzau@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/a83ccbf8a6b6
Disable @-moz-document in content pages r=emilio
Keywords: checkin-needed
(In reply to Emilio Cobos Álvarez [:emilio] from comment #6)
> (In reply to Kohei Yoshino [:kohei] from comment #5)
> > Posted the site compatibility note:
> > https://www.fxsitecompat.com/en-CA/docs/2018/moz-document-has-been-dropped/
> 
> Beware of bug 1446470, which will fix all the known breakages so far too,
> and is intended to land in time for the same firefox release.
> 
> That bug means that @-moz-document url-prefix() { } will keep working.

We should probably post an update to the Intent to unship thread in dev-platform about this plan as well.
https://hg.mozilla.org/mozilla-central/rev/a83ccbf8a6b6
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla61
I've updated the compat data to capture this: https://developer.mozilla.org/en-US/docs/Web/CSS/@document#Browser_compatibility

Marking dev-doc-complete, but please comment if we need anything else.
(In reply to Will Bamberg [:wbamberg] from comment #13)
> I've updated the compat data to capture this:
> https://developer.mozilla.org/en-US/docs/Web/CSS/
> @document#Browser_compatibility
> 
> Marking dev-doc-complete, but please comment if we need anything else.

I also added a rel note:

https://developer.mozilla.org/en-US/Firefox/Releases/61#CSS
Whiteboard: [adv-main61-]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: