1689420 - Fix origin header for null principal content dialogs (e.g. alert/prompt/confirm from data: URI pages or sandboxed iframes)

Status: RESOLVED FIXED

(Toolkit Graveyard :: Notifications and Alerts, defect, P1)

Description

[Daniel Holbert [:dholbert]]

STR:
(1) Visit data:text/html,<script>alert("hi");</script>
(2) Look at the alert that appears.

ACTUAL RESULTS:
The alert has this line of header text:

The page at moz-nullprincipal: says:

EXPECTED RESULTS:
We shouldn't be using moz-nullprincipal: in user-facing strings.

This principal is perhaps something we should be checking for as a special-case (in our JS), and just using a simpler header string like This page says:

Comment 1

[Daniel Holbert [:dholbert]]

I'm using Nightly 87.0a1 (2021-01-27) (64-bit)

Comment 2

[Daniel Holbert [:dholbert]]

Looks like this text was added in bug 1682393.

Micah, mind taking a look? Could we add a special-case for alerts from moz-nullprincipal: to avoid putting that string in front of users?

Comment 3

[Daniel Holbert [:dholbert]]

Attachment: screenshot

Comment 4

[Micah [:mtigley] (she/her)]

Yep, I can take a look!

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1682393

Comment 6

[Micah [:mtigley] (she/her)]

Attachment: Bug 1689420 - Fix origin header for null principal content dialogs. r?Gijs

Comment 7

[:Gijs (he/him)]

As noted on phabricator, it's a recent regression (held to nightly + early beta) for toplevel data: URIs, but the same bug actually pre-dated all our changes here, for the sandboxed iframes. The regressor there was bug 1594781

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Security' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The product::component has been changed since the backlog priority was decided, so we're resetting it.
For more information, please visit auto_nag documentation.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/85fc997b1e57
Fix origin header for null principal content dialogs. r=Gijs

Comment 11

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/85fc997b1e57

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:mtigley, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.