1476632 - Security Review: Layout engine changes for CSS Shapes support

Status: RESOLVED WONTFIX

(Firefox Graveyard :: Security: Review Requests, enhancement)

Description

[Christiane Ruetten [INACTIVE]]

This if for tracking the review requirement that came out of the CSS Shapes Risk assessment in bug 1451642.

Comment 1

[Frederik Braun [:freddy]]

Not to self: this is useful reading https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Shapes/Overview_of_CSS_Shapes

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

What is the planned work here? Is this "test the CSS shapes feature and see if there any overlooked security edge cases" ?

Comment 3

[Christiane Ruetten [INACTIVE]]

I don't know yet how to approach this in terms of testing.

Comment 4

[Paul Theriault [:pauljt] (no longer reading bugmail)]

(In reply to Christiane Ruetten [:cr] from comment #3)
> I don't know yet how to approach this in terms of testing.

The question was as much "is there anything we can practically test"? Im not sure there really is - about the only threat I can think of (apart from implementation bugs) is perhaps some kind of cross-origin inference of data based on occlusion or something. But that sounds more like a research project that something we can practically achieve in the short term.

Comment 5

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Dropping to prioritse other things.