1491490 - Kill wantXrays

Status: NEW

(Core :: XPConnect, enhancement, P3)

Description

[Bobby Holley (:bholley)]

See bug 1491488 comment 6.

Comment 1

[Bobby Holley (:bholley)]

I wrote a 1-line patch to always set wantXrays to false, and see what breaks:

https://treeherder.mozilla.org/#/jobs?repo=try&revision=2aa151d3be75aacf25083f00d835c921ab6ff669

Comment 2

[Andrew Overholt [:overholt]]

(In reply to Bobby Holley (:bholley) from comment #1)
> I wrote a 1-line patch to always set wantXrays to false, and see what breaks:
> 
> https://treeherder.mozilla.org/#/
> jobs?repo=try&revision=2aa151d3be75aacf25083f00d835c921ab6ff669

Not *too* orange :)

Comment 3

[Kris Maglione [:kmag]]

(In reply to Andrew Overholt [:overholt] from comment #2)
> (In reply to Bobby Holley (:bholley) from comment #1)
> > I wrote a 1-line patch to always set wantXrays to false, and see what breaks:
> > 
> > https://treeherder.mozilla.org/#/
> > jobs?repo=try&revision=2aa151d3be75aacf25083f00d835c921ab6ff669
> 
> Not *too* orange :)

Fortunately, most of that orange is just tests of Sandbox X-ray functionality. It looks like the devtools tests are doing something a bit weird. Not sure what.

Not quite sure about the Marionette harness one either. We may need to change that to create content sandboxes with an expanded principal.

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Hi Bobby, is that a thing you want to see fixed somewhat in the near future?

Comment 5

[Bobby Holley (:bholley)]

(In reply to Henrik Skupin (:whimboo) from comment #4)
> Hi Bobby, is that a thing you want to see fixed somewhat in the near future?

Yes, though I'm unlikely to get to it in the next few weeks.

I don't think this needs to block bug 1274251 though. You can just set wantXrays to false in all your sandboxes, which will give you the new behavior, and is one of the things we'd need to do to get this bug landed anyway.

Comment 6

[Bobby Holley (:bholley)]

And for the sandboxes where you're currently relying on it to get Xray vision, you should use an Expanded Principal [1] instead.

[1] https://developer.mozilla.org/en-US/docs/Mozilla/Gecko/Script_security#Expanded_principal