1570062 - Whitelist what's new "moments" pages

Status: RESOLVED FIXED

(Firefox :: Messaging System, enhancement, P1)

Description

[Kate Hudson :k88hudson]

In Bug 1568692 we landed some code to trigger a moments page based on a pref value. We might want to consider whitelisting the domains that are allowed to be shown if we think that's necessary.

Comment 1

[Andrei Oprea [:andreio]]

Following up with sec.

Comment 2

[Frederik Braun [:freddy]]

If its easy to whitelist mozilla.org, firefox.com etc. domains, I'd recommend just doing that. Alternatively, I suggest you ask for a security review meeting with Dan Veditz and team using the [e-mail] email address.

Comment 3

[Ed Lee :Mardak]

I'll have it allow https: mozilla.org and firefox.com base domains

Comment 4

[Ed Lee :Mardak]

Attachment: Bug 1570062 - Whitelist what's new "moments" pages

Use URL to parse and eTLD to extract allowed domains

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d95d741d5b75
Whitelist what's new "moments" pages r=k88hudson

Comment 6

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/d95d741d5b75

Comment 7

[Ed Lee :Mardak]

Comment on attachment 9083866 [details]
Bug 1570062 - Whitelist what's new "moments" pages

Beta/Release Uplift Approval Request

• User impact if declined: Undesired urls could be shown at startup
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: 1) create new string pref browser.startup.homepage_override.once set to {"url":"https://example.com/|https://www.mozilla.org/%LOCALE%/etc/firefox/retention/thank-you-a/"}

2. restart firefox
3. see both a thank you page (https://www.mozilla.org/en-US/etc/firefox/retention/thank-you-a/) and home page tabs but not https://example.com/

• List of other uplifts needed: Bug 1568692
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Slight modification to the behavior from bug 1568692 which is default off.
• String changes made/needed: none

Comment 8

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9083866 [details]
Bug 1570062 - Whitelist what's new "moments" pages

Work in support of the approved relationship scoping projects targeting Fx69. Approved for 69.0b14.

Comment 9

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/8107e7f68e12