1544011 - Discovery pane should not load discovery.addons.mozilla.org using the system principal

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, defect, P3)

Description

[Frederik Braun [:freddy]]

bug 1513445 disallows loading remote documents (i.e., over HTTPS/HTTP/FTP) with the systemprincipal in debug builds.

It will get an exception in bug 1544008, so I the feature still works. But I also believe that we should not load documents with the systemprincipal.

Comment 1

[Rob Wu [:robwu]]

Before closing this bug, make sure that https://searchfox.org/mozilla-central/rev/6c9f60f8cc064a1005cd8141ecd526578ae9da7a/dom/security/nsContentSecurityManager.cpp#831 is addressed.

Comment 2

[Rob Wu [:robwu]]

The relevant code can be removed when we rip out the XUL about:addons (specifically the remote discopane part of it that is activated by setting the extensions.htmlaboutaddons.discover.enabled=false pref).

Comment 3

[:Gijs (he/him)]

Mark, I think the code at https://searchfox.org/mozilla-central/rev/96f1457323cc598a36f5701f8e67aedaf97acfcf/dom/security/nsContentSecurityManager.cpp#828-839 can go away now (now that bug 1337627 is fixed in 73), right? We no longer load that as a document, and I also don't think the pref is used anymore, so probably most of what's at https://searchfox.org/mozilla-central/search?q=extensions.webservice.discoverURL can also be removed?

Comment 4

[Mark Striemer [:mstriemer]]

Yes, that pref is no longer being used. Looks like all references to the pref can be removed.

The const defined in head.js only leads to browser_history_navigation.js. That file can have the MAIN_URL const removed along with the url argument from the is_in_discover helper. I can file a follow up for that, just not setting the pref should unblock this.

Comment 5

[Frederik Braun [:freddy]]

Taking this one to remove the exception for the discovery pane URL, right now. This helps me as it minimizes unexpected conflicts with bug 1613609, that I'm working on in parallel.

Mark, please go ahead and file the follow-up to remove other mentions of extensions.webservice.discoverURL as laid out in comment 4.

Comment 6

[Frederik Braun [:freddy]]

Attachment: Bug 1544011 - remove exception that SystemPrincipal may open discovery pane r=ckerschb

Comment 7

[Frederik Braun [:freddy]]

(In reply to Frederik Braun [:freddy] from comment #5)

Mark, please go ahead and file the follow-up to remove other mentions of extensions.webservice.discoverURL as laid out in comment 4.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9356ffda1a9c
remove exception that SystemPrincipal may open discovery pane r=ckerschb

Comment 9

[Mark Striemer [:mstriemer]]

Filed bug 1620438.

Comment 10

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/9356ffda1a9c