1655714 - Inappropriate use of nsContentPolicyType::TYPE_OTHER in nsMessageManagerScriptExecutor::TryCacheLoadAndCompileScript( )

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, task)

Description

[Frederik Braun [:freddy]]

The file at https://searchfox.org/mozilla-central/source/dom/base/nsFrameMessageManager.cpp#1209 is using TYPE_OTHER for loading scripts.

To ensure that all existing security checks are monitoring the right kind of loads, it seems more appropriate to use TYPE_SCRIPT.

For more information, see the blocking meta bug 1651987

Comment 1

[Frederik Braun [:freddy]]

Attachment: Bug 1655714 - Add TYPE_INTERNAL_FRAME_MESSAGEMANAGER_SCRIPT and use in TryCacheLoadAndCompileScript(), r?kmag

Comment 2

[Frederik Braun [:freddy]]

let's see if this passes https://treeherder.mozilla.org/#/jobs?repo=try&revision=e17a0b1dd8b10485bd4e45d1a10127bfc7342d73

Comment 3

[Frederik Braun [:freddy]]

This is all green on try.
@ckerschb: kmag wondered if we should add a new type. Dunno if they are cheap / for free. We can land as-is or add a new nsicontentpolicytype. Do you have a preference?

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

(In reply to Frederik Braun [:freddy] from comment #3)

This is all green on try.
@ckerschb: kmag wondered if we should add a new type. Dunno if they are cheap / for free. We can land as-is or add a new nsicontentpolicytype. Do you have a preference?

Replied on Phab: https://phabricator.services.mozilla.com/D85977#2682456

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/12683a4cbe49
Add TYPE_INTERNAL_FRAME_MESSAGEMANAGER_SCRIPT and use in TryCacheLoadAndCompileScript(), r=kmag

Comment 6

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/12683a4cbe49