1687570 - remove keyUsages from nsIX509Cert

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Only clientauthask.js uses nsIX509Cert.keyUsages, which makes it easy to replace using code added by the new certificate viewer.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Bug 1687570 - remove keyUsages from nsIX509Cert r?mbirghan!,johannh!

This moves some potentially dangerous certificate parsing from C++ to JS and
reduces usage of NSS types in PSM.

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Bug 1687570 - remove nsIX509Cert.keyUsages r?rmf

nsIX509Cert.keyUsages is only used by the front-end. As of bug 1688703, the new
certificate viewer utility files can be used anywhere in the front-end to
decode certificates. Since this code is JS instead of C/C++, this is
preferrable from the standpoint of reducing attack surface.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/49dd65ced6bd
remove nsIX509Cert.keyUsages r=johannh,dveditz

Comment 4

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/49dd65ced6bd