1639472 - Assertion failures triggered by about:addons with system-principal restrictions from Bug 1613609

Status: NEW

(Toolkit :: Add-ons Manager, defect, P3)

Description

[Luca Greco [:rpl] [:luca] [:lgreco]]

With the system-principal restriction applied in Bug 1613609, loading about:addons will trigger the assertion failure

Assertion failure: false (SystemPrincipal must not load remote documents.), at .../dom/security/nsContentSecurityManager.cpp:864

when loading the screenshot (and likely also the icons) for the discovery cards (as they are retrieved from AMO HTTP urls).

The patch from Bug 1613609 has been currently backed out, but this issue seems something that we should take into account before landing that patch again.

Comment 1

[Frederik Braun [:freddy]]

FWIW, I can see ourselves whitelisting image resources for the time being.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:mixedpuppy, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 4

[Shane Caraveo (:mixedpuppy)]

I'm setting a priority for now, but if there is a timeline that requires a higher priority please let me know.

Comment 5

[Frederik Braun [:freddy]]

Yeah, we'll have to switch gears and re-evaluate timelines. P3 is OK and we'll get back once we have a new plan.