Closed Bug 1731025 Opened 2 months ago Closed 2 months ago

SystemPrincipal Telemetry should avoid profiles with custom userChrome.css and avoid racing with the detection of custom hackery

Categories

(Core :: DOM: Security, enhancement, P2)

enhancement

Tracking

()

RESOLVED FIXED
95 Branch
Tracking Status
firefox95 --- fixed

People

(Reporter: freddy, Assigned: freddy)

Details

(Whiteboard: [domsecurity-active])

Attachments

(1 file)

We've made two observation through our telemetry:

  1. We still get pings from profiles that load JS hackery, for which it is really hard to enable enforcement (those privileged scripts often contain remote resources, eval, etc.)
  2. Some people only load CSS hacks,. without any custom JS.

As a result:
Ad 1: Thus, our checks can only work on the main thread, so we want to hold reporting telemetry in case where the check has yielded a positive result but also only when the check has run at all.
Ad 2: To detect custom privileged CSS, we now introduce a DetectCssHacks function that probes the toolkit.legacyUserProfileCustomizations.stylesheets pref and use it before reporting telemetry.

Pushed by fbraun@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/60edafe5dcc3
systemprincipal telemetry for userChrome.css profiles (and avoid racing with pref checks) r=ckerschb,tjr
Priority: -- → P2
Whiteboard: [domsecurity-active]

The backout confirms that we are seeing races with the string-pref check:

browser/base/content/test/performance/browser_preferences_usage.js | general.config.filename should not be accessed more than 40 times. - 412 <= 40 -

I'm not sure how we can ensure that our detection runs only once and at the right time though.

Flags: needinfo?(fbraun)

I've made some improvements to make this code less racy and more performant, but I think this test failure you saw was unrelated to my push.

Pushed by fbraun@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/fb51f3bf786f
systemprincipal telemetry for userChrome.css profiles (and avoid racing with pref checks) r=ckerschb,tjr
Status: ASSIGNED → RESOLVED
Closed: 2 months ago
Resolution: --- → FIXED
Target Milestone: --- → 95 Branch
You need to log in before you can comment on or make changes to this bug.