1498569 - Remove new Function from wizard.xml

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Vinothkumar Nagasayanan [:vinoth]]

Eval(), new Function() should never execute with system principal.It is being removed everywhere from our codebase as part of Bug 1473549.

The affected code which should be rewritten,
https://dxr.mozilla.org/mozilla-central/rev/c291143e24019097d087f9307e59b49facaf90cb/toolkit/content/widgets/wizard.xml#422

Comment 1

[Vinothkumar Nagasayanan [:vinoth]]

Attachment: Bug 1498569 - Replaced new Function in wizard.xml using loadsubscript

Comment 2

[Jonas Allmann [:jallmann]]

I have a question that also applies to Bug 1498566.
After replacing all onwizard*-attributes in the codebase by proper event handlers, can I just remove this block of code

https://searchfox.org/mozilla-central/source/toolkit/content/widgets/wizard.xml#419

entirely without replacement? And if yes, am I right that this documentation

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizard

would have to be adapted, because the attributes wont work anymore?

Comment 3

[:Gijs (out for now; he/him)]

(In reply to Jonas Allmann [:jallmann] from comment #2)

I have a question that also applies to Bug 1498566.
After replacing all onwizard*-attributes in the codebase by proper event handlers, can I just remove this block of code

https://searchfox.org/mozilla-central/source/toolkit/content/widgets/wizard.xml#419

entirely without replacement? And if yes, am I right that this documentation

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizard

would have to be adapted, because the attributes wont work anymore?

Yes for both of these. :-)

Comment 4

[Jonas Allmann [:jallmann]]

Attachment: Bug 1498569, Replace wizard.xml attributes with event listeners, r=gijs

• Removed all occurences of custom onwizard* attributes.
• Removed custom handler code from wizard.xml.
• Updated eval()-usage whitelist.

Comment 5

[Jonas Allmann [:jallmann]]

Dev-docs need to be updated as a consequence of this Bug.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizard

The attributes onextra1, onextra2, onwizardback, onwizardcancel, onwizardfinish, onwizardnext for the XUL-Element wizard are no longer supported. Using custom event handlers in the script code is recommended instead.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XUL/wizardpage

The attributes onpageadvanced, onpagehide, onpagerewound, onpageshow for the wizardpage Element are no longer supported either.

Comment 6

[Jonas Allmann [:jallmann]]

This Bug is ready to land, could you do that for me, ckerschb?

Comment 7

[:Gijs (out for now; he/him)]

I've triggered lando for you. In future, you can also set the 'checkin-needed' keyword on the bug.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/156372e0b165
Replace wizard.xml attributes with event listeners, r=Gijs

Comment 9

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/156372e0b165

Comment 10

[Chris Mills [:cmills]]

docs deleted as requested