Replace evalInSandbox from httpd.js

RESOLVED FIXED in Firefox 64

Status

enhancement
P2
normal
RESOLVED FIXED
11 months ago
11 months ago

People

(Reporter: vinoth, Assigned: vinoth)

Tracking

(Blocks 1 bug)

Version 3
mozilla64
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox64 fixed)

Details

Attachments

(1 attachment)

As part of Bug 1473549, we are in the process of adding an assertion to make sure that eval() is not executed with system principal.

evalInSandbox is used in httpd.js (https://dxr.mozilla.org/mozilla-central/rev/c2e3be6a1dd352b969a45f0b85e87674e24ad284/netwerk/test/httpserver/httpd.js#2804).

We need to replace it with alternatives.
Assignee: nobody → cegvinoth
Comment on attachment 9007178 [details]
Bug 1489455 - Replace evalInSandbox from httpd.js

Please kindly review the patch and let me know if changes are needed.
Attachment #9007178 - Flags: review?(ckerschb)
Comment on attachment 9007178 [details]
Bug 1489455 - Replace evalInSandbox from httpd.js

Hey Valentin, we are in the process of adding an assetion that we never call eval() in system privileged context. We identified a few places within our codebase where we do this, one is within this patch. So before we can add the assertion to make sure we don't ever call eval() in system land, we need to rewrite those parts in the code that currently do.

Would you be willing to accept that change?
Attachment #9007178 - Flags: review?(valentin.gosu)
Attachment #9007178 - Flags: review?(ckerschb)
Attachment #9007178 - Flags: review+
Comment on attachment 9007178 [details]
Bug 1489455 - Replace evalInSandbox from httpd.js

Valentin Gosu [:valentin] has approved the revision.
Attachment #9007178 - Flags: review+
Comment on attachment 9007178 [details]
Bug 1489455 - Replace evalInSandbox from httpd.js

Christoph Kerschbaumer [:ckerschb] has been removed from the revision.
Attachment #9007178 - Flags: review+
Keywords: checkin-needed
Attachment #9007178 - Flags: review?(valentin.gosu) → review+
Pushed by rvandermeulen@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/f2b03dfdb75b
Replace evalInSandbox from httpd.js r=valentin
Keywords: checkin-needed
https://hg.mozilla.org/mozilla-central/rev/f2b03dfdb75b
Status: NEW → RESOLVED
Closed: 11 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
You need to log in before you can comment on or make changes to this bug.