1550792 - Consider changing LoadInfo::LoadInfo to use IsSecureContext and !IsPotentiallyTrustworthyLoopbackURL

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Jonathan Kingston [:jkt] he/him]

In LoadInfo::LoadInfo we check for https loadingPrincipals however instead we could check for IsSecureContext and !IsPotentiallyTrustworthyLoopbackURL.

Comment 1

[Jonathan Kingston [:jkt] he/him]

Attachment: Bug 1550792 - Change to use IsSecureContext and !IsPotentiallyTrustworthyLoopbackURL

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:jkt, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 3

[Jonathan Kingston [:jkt] he/him]

Unassigning, sorry unlikely to get to this. From memory this caused issues / might not be what we want.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:ckerschb, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 5

[Christoph Kerschbaumer [:ckerschb, back on Aug 10th}]

Hm, something like that would be nice, because we are still using if (mLoadingPrincipal->SchemeIs("https")) { in the loadinfo for detecting if we are in a secure context or not.

Probably we should revisit that if we decide to invest more into mixed content level 2, hence I am marking this bug block Bug 1435733.

Comment 6

[June Wilde (she/her) [:jewilde]]

Attachment: Bug 1550792 - Change LoadInfo to use GetIsOriginPotentiallyTrustworthy; r=ckerschb

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/042aa9ec5d10
Change LoadInfo to use GetIsOriginPotentiallyTrustworthy; r=ckerschb,necko-reviewers,freddyb,kershaw,extension-reviewers,devtools-reviewers,robwu

Comment 8

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/042aa9ec5d10