1498566 - Remove new Function from dialog.xml

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Vinothkumar Nagasayanan [:vinoth]]

Eval(), new Function() should never execute with system principal.It is being removed everywhere from our codebase as part of Bug 1473549.

The affected code which should be rewritten,
https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/dialog.xml#418

Comment 1

[Vinothkumar Nagasayanan [:vinoth]]

Attachment: Bug 1498566 - Replaced new Function in dialog.xml using loadsubscript

Comment 2

[Vinothkumar Nagasayanan [:vinoth]]

In order to clarify the things I will summarize the changes required for this bug,

In order to remove the usage of new Function from dialog.xml[1], we need to remove the usage of attributes[2] ondialogaccept, ondialogcancel, ondialogdisclosure, ondialogextra1, ondialogextra2 and ondialoghelp from all the places within our codebase. Please correct me if I got something wrong about this approach.


[1] - https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/dialog.xml#418

[2] - https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/dialog#Attributes

Comment 3

[:Gijs (he/him)]

(In reply to Vinothkumar Nagasayanan [:vinoth] from comment #2)
> In order to clarify the things I will summarize the changes required for
> this bug,
> 
> In order to remove the usage of new Function from dialog.xml[1], we need to
> remove the usage of attributes[2] ondialogaccept, ondialogcancel,
> ondialogdisclosure, ondialogextra1, ondialogextra2 and ondialoghelp from all
> the places within our codebase. Please correct me if I got something wrong
> about this approach.

Yep, this seems fine; we'll need to use custom events to do the same thing that the attributes do today.

Comment 4

[Jonas Allmann [:jallmann]]

Attachment: Bug 1498566, Remove custom event handling code from dialog.xml, r=gijs

Remove the now obsolete event handling code including new Funcition. Remove dialog.xml from eval() whitelist.

Comment 5

[Jonas Allmann [:jallmann]]

Dev-Docs for the dialog XUL-Element need to be updated as a result of this bug.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/dialog#Attributes

The attributes ondialogaccept, ondialogcancel, ondialogdisclosure, ondialogextra1, ondialogextra2, ondialoghelp won't be supported anymore and should be removed from the docs. Using JS-eventHandlers is recommended instead.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4c124c1db332
Remove custom event handling code from dialog.xml, r=Gijs

Comment 7

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/4c124c1db332

Comment 8

[Chris Mills [:cmills]]

attributes removed from docs as instructed.