1543579 - Follow-up: Disallow http(s) resources to be loaded into system privileged documents for release builds

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Frederik Braun [:freddy]]

+++ This bug was initially created as a clone of Bug #1513445 +++

We should turn the debug assertion into a release assertion after the next merge, May 15th.

Comment 1

[Frederik Braun [:freddy]]

FWIW, we disallowed in nightly/early beta through bug 1552477. We will track this for a while until we make a decision.

Comment 2

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

I think the blocking bug for this was incorrect...

Comment 3

[Frederik Braun [:freddy]]

The assertion is enabled for nightly & early beta builds.

#ifdef EARLY_BETA_OR_EARLIER
  AssertSystemPrincipalMustNotLoadRemoteDocuments(aChannel);
#endif

No additional crashes according to this search for assertion failures in doContentSecurityCheck.

Are you OK with removing the ifdef and letting this ride the trains?

Comment 4

[Frederik Braun [:freddy]]

Attachment: Bug 1543579 - Disallow SystemPrincipal for Remote documents on all channels r=ckerschb,tjr

Comment 5

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Frederik Braun [:freddyb] from comment #3)

Are you OK with removing the ifdef and letting this ride the trains?

Yes, already accepted the patch :-)

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/60cf9b754257
Disallow SystemPrincipal for Remote documents on all channels r=ckerschb,tjr

Comment 7

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/60cf9b754257