Remove new Function from wizard.xml

RESOLVED FIXED in Firefox 68

Status

()

enhancement
P3
normal
RESOLVED FIXED
6 months ago
13 days ago

People

(Reporter: vinoth, Assigned: jallmann)

Tracking

(Blocks 1 bug, {dev-doc-needed})

unspecified
mozilla68
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox68 fixed)

Details

(Whiteboard: [domsecurity-backlog1])

Attachments

(2 attachments)

(Reporter)

Description

6 months ago
Eval(), new Function() should never execute with system principal.It is being removed everywhere from our codebase as part of Bug 1473549.

The affected code which should be rewritten,
https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/wizard.xml#422
(Reporter)

Updated

6 months ago
Component: General → DOM: Security
Product: Toolkit → Core
Whiteboard: [domsecurity-backlog1]
(Reporter)

Updated

5 months ago
Assignee: nobody → cegvinoth
Status: NEW → ASSIGNED
(Reporter)

Updated

3 months ago
Assignee: cegvinoth → nobody
Status: ASSIGNED → NEW
(Assignee)

Comment 2

a month ago

I have a question that also applies to Bug 1498566.
After replacing all onwizard*-attributes in the codebase by proper event handlers, can I just remove this block of code

https://searchfox.org/mozilla-central/source/toolkit/content/widgets/wizard.xml#419

entirely without replacement? And if yes, am I right that this documentation

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizard

would have to be adapted, because the attributes wont work anymore?

Flags: needinfo?(gijskruitbosch+bugs)

Comment 3

a month ago

(In reply to Jonas Allmann [:jallmann] from comment #2)

I have a question that also applies to Bug 1498566.
After replacing all onwizard*-attributes in the codebase by proper event handlers, can I just remove this block of code

https://searchfox.org/mozilla-central/source/toolkit/content/widgets/wizard.xml#419

entirely without replacement? And if yes, am I right that this documentation

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizard

would have to be adapted, because the attributes wont work anymore?

Yes for both of these. :-)

Flags: needinfo?(gijskruitbosch+bugs)
(Assignee)

Updated

a month ago
Assignee: nobody → jallmann
(Assignee)

Comment 4

a month ago
  • Removed all occurences of custom onwizard* attributes.
  • Removed custom handler code from wizard.xml.
  • Updated eval()-usage whitelist.
(Assignee)

Updated

27 days ago
Status: NEW → ASSIGNED
(Assignee)

Comment 5

20 days ago

Dev-docs need to be updated as a consequence of this Bug.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizard

The attributes onextra1, onextra2, onwizardback, onwizardcancel, onwizardfinish, onwizardnext for the XUL-Element wizard are no longer supported. Using custom event handlers in the script code is recommended instead.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizardpage

The attributes onpageadvanced, onpagehide, onpagerewound, onpageshow for the wizardpage Element are no longer supported either.

Keywords: dev-doc-needed
(Assignee)

Comment 6

20 days ago

This Bug is ready to land, could you do that for me, ckerschb?

Flags: needinfo?(ckerschb)

Comment 7

20 days ago

I've triggered lando for you. In future, you can also set the 'checkin-needed' keyword on the bug.

Flags: needinfo?(ckerschb)

Comment 8

20 days ago
Pushed by gijskruitbosch@gmail.com:
https://hg.mozilla.org/integration/autoland/rev/156372e0b165
Replace wizard.xml attributes with event listeners, r=Gijs

Comment 9

20 days ago
bugherder
Status: ASSIGNED → RESOLVED
Last Resolved: 20 days ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla68

Updated

20 days ago
Depends on: 1541136

Updated

14 days ago
Regressions: 1542844

Updated

13 days ago
No longer regressions: 1542844
You need to log in before you can comment on or make changes to this bug.