Remove new Function from dialog.xml

RESOLVED FIXED in Firefox 68

Status

()

enhancement
P3
normal
RESOLVED FIXED
9 months ago
2 months ago

People

(Reporter: vinoth, Assigned: jallmann)

Tracking

(Blocks 1 bug, {dev-doc-complete})

unspecified
mozilla68
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox68 fixed)

Details

(Whiteboard: [domsecurity-backlog1])

Attachments

(2 attachments)

Eval(), new Function() should never execute with system principal.It is being removed everywhere from our codebase as part of Bug 1473549.

The affected code which should be rewritten,
https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/dialog.xml#418
Component: XUL Widgets → DOM: Security
Product: Toolkit → Core
Whiteboard: [domsecurity-backlog1]
Assignee: nobody → cegvinoth
Status: NEW → ASSIGNED
In order to clarify the things I will summarize the changes required for this bug,

In order to remove the usage of new Function from dialog.xml[1], we need to remove the usage of attributes[2] ondialogaccept, ondialogcancel, ondialogdisclosure, ondialogextra1, ondialogextra2 and ondialoghelp from all the places within our codebase. Please correct me if I got something wrong about this approach.


[1] - https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/dialog.xml#418

[2] - https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/dialog#Attributes
Flags: needinfo?(gijskruitbosch+bugs)
(In reply to Vinothkumar Nagasayanan [:vinoth] from comment #2)
> In order to clarify the things I will summarize the changes required for
> this bug,
> 
> In order to remove the usage of new Function from dialog.xml[1], we need to
> remove the usage of attributes[2] ondialogaccept, ondialogcancel,
> ondialogdisclosure, ondialogextra1, ondialogextra2 and ondialoghelp from all
> the places within our codebase. Please correct me if I got something wrong
> about this approach.

Yep, this seems fine; we'll need to use custom events to do the same thing that the attributes do today.
Flags: needinfo?(gijskruitbosch+bugs)
Depends on: 1521040
Depends on: 1521505
Assignee: cegvinoth → nobody
Status: ASSIGNED → NEW
Assignee: nobody → jallmann
Depends on: 1525636
Depends on: 1529231
Status: NEW → ASSIGNED

Remove the now obsolete event handling code including new Funcition. Remove dialog.xml from eval() whitelist.

Keywords: checkin-needed

Dev-Docs for the dialog XUL-Element need to be updated as a result of this bug.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/dialog#Attributes

The attributes ondialogaccept, ondialogcancel, ondialogdisclosure, ondialogextra1, ondialogextra2, ondialoghelp won't be supported anymore and should be removed from the docs. Using JS-eventHandlers is recommended instead.

Keywords: dev-doc-needed

Pushed by dluca@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/4c124c1db332
Remove custom event handling code from dialog.xml, r=Gijs

Keywords: checkin-needed
Status: ASSIGNED → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68

attributes removed from docs as instructed.

You need to log in before you can comment on or make changes to this bug.