1512511 - (CVE-2019-11724) Remove input.mozilla.org from browser/app/permissions

Status: RESOLVED FIXED

(Firefox :: General, enhancement, P3)

Description

[Frederik Braun [:freddy]]

browser/app/permissions gives extra permission "remote-troubleshooting" to input.mozilla.org, which is now redirecting to qsurvey.

We probably do not want to give extra permission to input.m.o.

Comment 1

[Frederik Braun [:freddy]]

Attachment: Bug 1512511: remove extra-privileges for input.mozilla.org

There are domains that we give extra permissions.
Those should be hosted and operated by Firefox.
input.mozilla.org isn't and it also doesnt use extra permissions anymore.
Let's remove it.

Comment 2

[Frederik Braun [:freddy]]

NB: As a follow-up, I likely want to look at other domains.

Comment 3

[:Gijs (he/him)]

I swear I asked you this recently but I can't find where I did. What's the state of this bug? Can the patch here just land?

Comment 4

[Frederik Braun [:freddy]]

This bug is on my list, but with a relatively low priority.

According to https://phabricator.services.mozilla.com/D13948#347996, I better add code that makes the pref change for existing profiles, before I land.

Comment 5

[Carolina Jimenez Gomez]

(In reply to Frederik Braun [:freddyb] from comment #4)

This bug is on my list, but with a relatively low priority.

According to https://phabricator.services.mozilla.com/D13948#347996, I better add code that makes the pref change for existing profiles, before I land.

Hello, I'm an outreachy applicant, can I help solving this?

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/41c4503d65cb
Remove extra-privileges for input.mozilla.org. r=Gijs,MattN

Comment 7

[Matthew N. [:MattN]]

(In reply to Carolina Jimenez Gomez from comment #5)

(In reply to Frederik Braun [:freddyb] from comment #4)

This bug is on my list, but with a relatively low priority.

According to https://phabricator.services.mozilla.com/D13948#347996, I better add code that makes the pref change for existing profiles, before I land.

Hello, I'm an outreachy applicant, can I help solving this?

I just landed this existing patch and will file a follow-up to remove the existing stored permissions. You can work on that one.

Comment 8

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/41c4503d65cb