1648445 - Backout - bypassCORSChecks

Status: RESOLVED DUPLICATE of bug 1645204

(Core :: Networking: HTTP, defect)

Description

[Sebastian Streich [:sstreich]]

As Rob described in Bug 1645204 , our handling of bypassCORSChecks leaves a huge vulnerably open for our users. Regressed by bug 1450965. Fortunately this was in 69, so ESR68 is not affected. As the next ESR release is so close, I would like to backout the changes made in bug 1450965.
We will still work on the fixing the original Bug in 1645204 asap.

i would like to remove the risk of shipping the vuln, since the original bug we tried to fix had only a small impact on users. Since the regressing patch did not land on ESR, backouting it would pose no negative effect for our esr users.

Comment 1

[Sebastian Streich [:sstreich]]

Attachment: Bug 1648445 - Remove bypassCORSChecks flags r=robwu

Comment 2

[Sebastian Streich [:sstreich]]

[Tracking Requested - why for this release]: See Comment 0 🙈

Comment 3

[Rob Wu [:robwu]]

FYI: If the patch size is a concern, then note that the sec bug itself can be avoided by one patch with two small changes:

• Remove https://searchfox.org/mozilla-central/rev/a87a1c3b543475276e6d57a7a80cb02f3e42b6ed/toolkit/components/extensions/webrequest/WebRequest.jsm#995-1001
• Add skip-if = true at https://searchfox.org/mozilla-central/rev/a87a1c3b543475276e6d57a7a80cb02f3e42b6ed/toolkit/components/extensions/test/mochitest/mochitest-common.ini#178

Comment 4

[Rob Wu [:robwu]]

Since ESR78 has already shipped with the feature from bug 1450965, we shouldn't just back out the patch.

For that reason, I suggest to move the patch back to bug 1645204. That bug already has a real fix, so the patch here is just removal of unused code. There is not really a need for two separate bugs.

@sstreich, could you move this patch back to bug 1450965, and mark this bug as a duplicate of it?

Comment 5

[Phabricator Automation]

Comment on attachment 9159253 [details]
Bug 1648445 - Remove bypassCORSChecks flags r=robwu

Revision D80956 was moved to bug 1645204. Setting attachment 9159253 [details] to obsolete.

Comment 6

[Sebastian Streich [:sstreich]]

sure, moved it back :)