1607403 - Reshuffle secure context prefs

Status: NEW

(Core :: DOM: Security, enhancement, P3)

Description

[Jonathan Kingston [:jkt] he/him]

I would like this bug to clean up:
dom.securecontext.whitelist
dom.securecontext.whitelist_onions

• Renaming whitelist to allowlist as it is more culturally accepting.
• Migrate data from prefs
• Making dom.securecontext.allowlist static as we don't need changes to be instant and the code is paying the cost.
• Remove security.mixed_content.block_active_content and security.mixed_content.block_display_content as they are covered already by the allowlist last time we checked there was a high adoption of these prefs and it's a pretty big footgun.
• Make security.mixed_content.block_object_subrequest and security.mixed_content.upgrade_display_content static as they won't change often either

Oddly static string prefs don't seem to compile at the moment.

Comment 1

[Jonathan Kingston [:jkt] he/him]

Attachment: Bug 1607403 - WIP pref cleanup

Comment 2

[Jonathan Kingston [:jkt] he/him]

After let-localhost-be-localhost bug we should also consider "network.proxy.allow_hijacking_localhost" to be renamed to something relating to "unsafe" or "insecure" also.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The bug assignee didn't login in Bugzilla in the last 7 months.
:ckerschb, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 4

[Christoph Kerschbaumer [:ckerschb}]

This would be nice, but backlog is fine for now.