https://install.mozilla.org should send strings through webchannels
Categories
(mozilla.org :: Miscellaneous, defect)
Tracking
(Not tracked)
People
(Reporter: markh, Unassigned)
References
Details
Bug 1238128 describes there is a risk allowing webchannels to send objects over a webchannel, and that instead strings should be sent, with the content side doing a stringify and the chrome side doing a parse of that string.
This preference indicates https://install.mozilla.org is still allowed to send objects. It should migrate to using strings (if it hasn't already) and the URL removed from that preference.
Bug 1275612 is tracking the removal of this capability entirely.
(Apologies if the component is incorrect - please adjust accordingly)
|
||
Comment 1•3 months ago
|
||
I don't see any uses of install.mozilla.org in the mozilla-central outside of two preference allow lists. Bug 1445663 says the domain did not exist as of 2018. Bug 1361953 comment 3 says it should be removed from the list, but no reason was given. There's no indication in bug 1238128 what was using it.
Bug 1238128 landed in Firefox 50. I don't see any uses of install.mozilla.org in either ESR45 or ESR60, so I'm not sure where it came from. Outside of tests, the only consumers of WebChannel I see (based on looking for for new WebChannel and .WebChannel) in ESR45 and ESR60 are remote-troubleshooting, FxAccounts, and Loop.
Description
•