1498885 - Add assertion in ContentSecurityPolicyPermitsJSAction() to not allow eval with SystemPrincipal

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Vinothkumar Nagasayanan [:vinoth]]

Eval(), new Function() should never execute with system principal.It is being removed everywhere from our codebase as part of Bug 1473549.

Here assertion will be added in ContentSecurityPolicyPermitsJSAction() in nsScriptSecurityManager.cpp and a pref will be added to disable the assertion for specific test files.

Comment 1

[Vinothkumar Nagasayanan [:vinoth]]

Attachment: Bug 1498885 - Assertion added in ContentSecurityPolicyPermitsJSAction() to not allow eval with SystemPrincipal

Comment 2

[Vinothkumar Nagasayanan [:vinoth]]

Comment on attachment 9017085 [details]
Bug 1498885 - Assertion added in ContentSecurityPolicyPermitsJSAction() to not allow eval with SystemPrincipal

I added the assertion and prefs to few test files. Assertion was turned off for now till we fix all the issues.
Please kindly review the patch and let me know if changes are needed.
Try server push for this patch,
https://treeherder.mozilla.org/#/jobs?repo=try&revision=a317eb0aebfc1143c0211a5ab1319b6267d62267

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/237852763567
Assertion added in ContentSecurityPolicyPermitsJSAction() to not allow eval with SystemPrincipal r=ckerschb

Comment 4

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/237852763567

Comment 5

[Kris Maglione [:kmag]]

(In reply to Bogdan Tara[:bogdan_tara] from comment #4)
> https://hg.mozilla.org/mozilla-central/rev/237852763567

\o/

Also, please send an email to dev-platform about this. Thanks

Comment 6

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Kris Maglione [:kmag] from comment #5)
> Also, please send an email to dev-platform about this. Thanks

FWIW, the assertion is not actively firing as of now. Once Bug 1473549 is fixed, we will send an email to dev-platform about those changes.