1614008 - Disable eval() usage if the user has a PAC Script set (or we are executing a pac script)

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Tom Ritter [:tjr]]

In Berlin, late at night, :nika suggested that the remaining traces of eval() occurring might be coming from PAC Scripts. Let's disable the eval assertions then and see what happens!

Comment 1

[Tom Ritter [:tjr]]

network.proxy.autoconfig_url

Comment 2

[Tom Ritter [:tjr]]

Attachment: Bug 1614008 - Disable eval checks for PAC Scripts r?jandem

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d593e775210f
Disable eval checks for PAC Scripts r=jandem

Comment 4

[Cristina Coroiu [:ccoroiu]]

https://hg.mozilla.org/mozilla-central/rev/d593e775210f

Comment 5

[Tom Ritter [:tjr]]

[Tracking Requested - why for this release]:

In Bug 1611238 in 74 we are going to enforce eval restrictions. In this bug we believe we have identified what may be some last lingering sources of the telemetry we were seeing. Here we'll disable the eval restrictions for PAC Scripts. Not taking this in 74 would mean that 74 in release, if a PAC script used eval - it would not work.

We should either hold back Bug 1611238 or uplift this bug to 74. I'd prefer t uplift this bug, because it's a safe uplift (it's disabling a security feature) and I'd prefer to avoid holding back the security feature for another release.

Comment 6

[Tom Ritter [:tjr]]

Comment on attachment 9127955 [details]
Bug 1614008 - Disable eval checks for PAC Scripts r?jandem

Beta/Release Uplift Approval Request

• User impact if declined: See Comment 5
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This is a small patch that disables a security check.
• String changes made/needed:

Comment 7

[Pascal Chevrel:pascalc]

Comment on attachment 9127955 [details]
Bug 1614008 - Disable eval checks for PAC Scripts r?jandem

The justification seems reasonable to me, uplift approved for 74.0b8, thanks.

Comment 8

[Natalia Csoregi [:nataliaCs]]

https://hg.mozilla.org/releases/mozilla-beta/rev/19f46233c83f