Closed Bug 1427727 Opened 6 years ago Closed 3 years ago

Make setSlot/setElement more robust

Categories

(Core :: JavaScript Engine, enhancement, P2)

Product:
Core
Component:
JavaScript Engine
Type:
enhancement

Tracking

()

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox59 --- wontfix

People

(Reporter: jandem, Unassigned)

Details

(Keywords: sec-audit) 

We sometimes have TI bugs like bug 1427126 because people use setSlot/setElement instead of setSlotWithType/setElementWithType.

This is a footgun we should fix. I think we should:

* Rename setSlot and setElement to something more scary, like setSlotNoTypeUpdate.

* Make these functions assert TI correctness.
This might reveal security bugs.
Keywords: sec-audit
Flags: needinfo?(jdemooij)
status-firefox59: --- → fix-optional
Priority: -- → P2
I'm not working on this right now. I still think it's worth doing at some point, but we're not aware of any issues atm.
Flags: needinfo?(jdemooij)

TI was removed and that gun is no longer pointed at any feet.

Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Group: javascript-core-security → core-security-release
status-firefox59: fix-optional → wontfix
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.