Remove eval from loadPrivilegedScript() in specialpowersAPI.js

RESOLVED FIXED in Firefox 64

Status

()

enhancement
P2
normal
RESOLVED FIXED
9 months ago
8 months ago

People

(Reporter: vinoth, Assigned: vinoth)

Tracking

(Blocks 1 bug)

unspecified
mozilla64
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox64 fixed)

Details

(Whiteboard: [domsecurity-active])

Attachments

(1 attachment)

As part of Bug 1473549, we are in the process of adding an assertion to make sure that eval() is not executed with system principal.

Eval() has been used in loadPrivilegedScript() in specialpowersAPI.js, We need to remove this eval() and replace it with someother alternative.
Hi,

Please see comment 1, It seems that this eval() (https://dxr.mozilla.org/mozilla-central/rev/7ed950e60f3c1f8a47c117c04124d31e94a66e32/testing/specialpowers/content/specialpowersAPI.js#520) is added as part of Bug 1260076 by you and please take a look at. 
Apparently we need to remove this eval from that function.
Let me know you comments.
Flags: needinfo?(juhsu)
Whiteboard: [domsecurity-active]

Comment 2

9 months ago
AFAICT The goal is to load the chrome privileged script in the content process for testing, basically for Presentation API.
I don't have a good idea how to replace it.
If it's too hard and asserting |eval()| matters, you can disable the relative tests.
Flags: needinfo?(juhsu)
Comment on attachment 9015183 [details]
Bug 1491759 - Replaced eval with loadSubScript from loadPrivilegedScript() in specialpowersAPI.js

I have replaced eval() with loadsubscript().
Please kindly review the patch and let me know if changes are needed.

Try server push for this change is,
https://treeherder.mozilla.org/#/jobs?repo=try&revision=eb7603d26895cd46f58bca4ae69fb4c291d6f37c
Attachment #9015183 - Flags: review?(juhsu)

Updated

8 months ago
Attachment #9015183 - Flags: review?(juhsu) → review+
Assignee

Updated

8 months ago
Keywords: checkin-needed

Comment 5

8 months ago
Pushed by ebalazs@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/1bae9022b97e
Replaced eval with loadSubScript from loadPrivilegedScript() in specialpowersAPI.js r=JuniorHsu
Keywords: checkin-needed

Comment 6

8 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/1bae9022b97e
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
You need to log in before you can comment on or make changes to this bug.