Remove new Function from dialog.xml

RESOLVED FIXED in Firefox 68

Status

()

enhancement
P3
normal
RESOLVED FIXED
7 months ago
21 days ago

People

(Reporter: vinoth, Assigned: jallmann)

Tracking

(Blocks 1 bug, {dev-doc-needed})

unspecified
mozilla68
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox68 fixed)

Details

(Whiteboard: [domsecurity-backlog1])

Attachments

(2 attachments)

(Reporter)

Description

7 months ago
Eval(), new Function() should never execute with system principal.It is being removed everywhere from our codebase as part of Bug 1473549.

The affected code which should be rewritten,
https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/dialog.xml#418
(Reporter)

Updated

7 months ago
Component: XUL Widgets → DOM: Security
Product: Toolkit → Core
Whiteboard: [domsecurity-backlog1]
(Reporter)

Updated

5 months ago
Assignee: nobody → cegvinoth
Status: NEW → ASSIGNED
(Reporter)

Comment 2

4 months ago
In order to clarify the things I will summarize the changes required for this bug,

In order to remove the usage of new Function from dialog.xml[1], we need to remove the usage of attributes[2] ondialogaccept, ondialogcancel, ondialogdisclosure, ondialogextra1, ondialogextra2 and ondialoghelp from all the places within our codebase. Please correct me if I got something wrong about this approach.


[1] - https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/dialog.xml#418

[2] - https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/dialog#Attributes
Flags: needinfo?(gijskruitbosch+bugs)

Comment 3

4 months ago
(In reply to Vinothkumar Nagasayanan [:vinoth] from comment #2)
> In order to clarify the things I will summarize the changes required for
> this bug,
> 
> In order to remove the usage of new Function from dialog.xml[1], we need to
> remove the usage of attributes[2] ondialogaccept, ondialogcancel,
> ondialogdisclosure, ondialogextra1, ondialogextra2 and ondialoghelp from all
> the places within our codebase. Please correct me if I got something wrong
> about this approach.

Yep, this seems fine; we'll need to use custom events to do the same thing that the attributes do today.
Flags: needinfo?(gijskruitbosch+bugs)
(Reporter)

Updated

3 months ago
Depends on: 1521040
(Reporter)

Updated

3 months ago
Depends on: 1521505
(Reporter)

Updated

3 months ago
Assignee: cegvinoth → nobody
Status: ASSIGNED → NEW
(Assignee)

Updated

3 months ago
Assignee: nobody → jallmann
(Assignee)

Updated

3 months ago
Depends on: 1525636
(Assignee)

Updated

2 months ago
Depends on: 1529231
(Assignee)

Updated

a month ago
Status: NEW → ASSIGNED
(Assignee)

Comment 4

23 days ago

Remove the now obsolete event handling code including new Funcition. Remove dialog.xml from eval() whitelist.

(Assignee)

Updated

22 days ago
Keywords: checkin-needed
(Assignee)

Comment 5

22 days ago

Dev-Docs for the dialog XUL-Element need to be updated as a result of this bug.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/dialog#Attributes

The attributes ondialogaccept, ondialogcancel, ondialogdisclosure, ondialogextra1, ondialogextra2, ondialoghelp won't be supported anymore and should be removed from the docs. Using JS-eventHandlers is recommended instead.

Keywords: dev-doc-needed

Comment 6

22 days ago

Pushed by dluca@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/4c124c1db332
Remove custom event handling code from dialog.xml, r=Gijs

Keywords: checkin-needed

Comment 7

21 days ago
bugherder
Status: ASSIGNED → RESOLVED
Last Resolved: 21 days ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68
You need to log in before you can comment on or make changes to this bug.