1662189 - Enforce eval() restrictions on release

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P1)

Description

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

The following query indicates that we have 17 unique clients reporting eval usage in Firefox 80 (and none in 77/78/79) since June 1. Of those, 13 are in release and the rest are in beta/nightly where enforcement is already enabled.

I think this number is low enough for us to enable the eval() restrictions in release.

SELECT event_object,
       event_method,
       event_string_value,
       app_version,
       normalized_channel,
       TO_JSON_STRING(event_map_values),
       event_process,
       count(*) AS count_reports,
       count(distinct client_id) as count_distinct_clients
FROM telemetry.events
WHERE event_category = 'security'
  AND submission_date >= '2020-06-1'
  AND app_version > '77'
  and event_method = 'evalUsage'
GROUP BY event_method,
         event_object,
         event_string_value,
         app_version,
         normalized_channel,
         TO_JSON_STRING(event_map_values),
         event_process
ORDER BY app_version desc, normalized_channel, event_string_value

Comment 1

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

Attachment: Bug 1662189 - Enforce eval() restrictions on release

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/cd7bcfed8ef6
Enforce eval() restrictions on release r=freddyb,ckerschb

Comment 3

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/cd7bcfed8ef6