1634262 - Refuse nested `Document.execCommand()` calls by default in release builds

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement, P3)

Description

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Currently, we don't have any regression reports for bug 1611374, and we should change it in release channel as soon as possible, but unfortunately, we shouldn't do this kind of changes under COVID-19 situation.

Comment 1

[Adam Stevenson [:adamopenweb]]

We've reviewed this with the Web Compatibility team and think it is a low risk to remove this from Firefox Release at this point.

Comment 2

[Masayuki Nakano [:masayuki] (he/him)(JST, +0900)]

Attachment: Bug 1634262 - Disallow recursive `Document.execCommand()` calls r=smaug!

It's disabled in the Nightly channel and early beta half a year ago, but there
are no regression reports and Chrome has already disabled it since 2014.
So, let's disable this feature on the Release channel (and late Beta) too
for better security and making simpler implementation in the future.

Depends on D87990

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f725948fa93a
Disallow recursive `Document.execCommand()` calls r=smaug

Comment 4

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/25245 for changes under testing/web-platform/tests

Comment 5

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/f725948fa93a

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot