1570738 - Prevent usage of eval() in any context in the Parent Process

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P2)

Description

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Assuming I did this try run successfully - we don't have any such usage!
https://treeherder.mozilla.org/#/jobs?repo=try&revision=3320cee4a3776e5f9eaf02a3c3470bb0c101ad87

I'm going to update the patch to collect telemetry and send it out to Nightly...

Comment 1

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: data-review.txt

This Data Review is basically a copy/paste as the one you just reviewed in Bug 1567623 - except now it's looking at eval usage in the parent process.

Comment 2

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: Bug 1570738 - Record Telemetry if eval() is used in the Parent Process

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug is a task, but please change it back in case of error.

Comment 4

[Chris H-C :chutten]

Comment on attachment 9082418 [details]
data-review.txt

( ni?ckerschb to clarify that they're fine with being nominated to permanently monitor this data )

DATA COLLECTION REVIEW RESPONSE:

    Is there or will there be documentation that describes the schema for the ultimate data set available publicly, complete and accurate?

Yes. This collection is Telemetry so is documented in its definitions file [Events.yaml](https://hg.mozilla.org/mozilla-central/file/tip/toolkit/components/telemetry/Events.yaml) and the [Probe Dictionary](https://telemetry.mozilla.org/probe-dictionary/).

    Is there a control mechanism that allows the user to turn the data collection on and off?

Yes. This collection is Telemetry so can be controlled through Firefox's Preferences.

    If the request is for permanent data collection, is there someone who will monitor the data over time?

Yes, ckershub is responsible.

    Using the category system of data types on the Mozilla wiki, what collection type of data do the requested measurements fall under?

Category 1, Technical.

    Is the data collection request for default-on or default-off?

Default on for all channels.

    Does the instrumentation include the addition of any new identifiers?

No.

    Is the data collection covered by the existing Firefox privacy notice?

Yes.

    Does there need to be a check-in in the future to determine whether to renew the data?

No. This collection is permanent.

---
Result: datareview+

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/428881fad4a8
Record Telemetry if eval() is used in the Parent Process r=ckerschb

Comment 7

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/428881fad4a8

Comment 8

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Chris H-C :chutten from comment #4)

Comment on attachment 9082418 [details]
data-review.txt

( ni?ckerschb to clarify that they're fine with being nominated to
permanently monitor this data )

Yes, that's fine with me. Thanks!