1880988 - The default summary for details doesn't honor spoof English

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[Pier Angelo Vendrame]

The <details> element will use a default summary when it doesn't contain a <summary> tag.
This default string is localized in the app language even when spoof English is active.
As far as I can tell this string isn't accessible, but if you set display: inline to the <details> element, you can measure the various localized strings.

I kindly ask you to keep this bug confidential at least for one month, because we plan to include the fix downstream in our next stable release scheduled for around March 19.

Comment 1

[Pier Angelo Vendrame]

Attachment: Bug 1880988 - Apply spoof English to the default detail summary. r?#anti-tracking

Comment 2

[Andrew McCreight [:mccr8]]

This is a minor change so maybe it doesn't really matter, but this looks more like a DOM or Layout change. (It looks like this mechanism was added in bug 1581537.)

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1308080

Comment 4

[Andrew McCreight [:mccr8]]

(In reply to Pier Angelo Vendrame from comment #0)

I kindly ask you to keep this bug confidential at least for one month, because we plan to include the fix downstream in our next stable release scheduled for around March 19.

It sounds like we should wait on landing this until Tor is ready to land it.

Comment 5

[Pier Angelo Vendrame]

(In reply to Andrew McCreight [:mccr8] from comment #4)

(In reply to Pier Angelo Vendrame from comment #0)

I kindly ask you to keep this bug confidential at least for one month, because we plan to include the fix downstream in our next stable release scheduled for around March 19.

It sounds like we should wait on landing this until Tor is ready to land it.

Thanks!
I think it'd be fine to land it, because the diff is very small and won't tell many details.
Actually, we already landed it to our nightly channel, we just haven't backported it to our stable channel yet, and we'll wait to lift confidentiality from our ticket until the first stable release that includes the fix.

Comment 6

[Andrew McCreight [:mccr8]]

Thanks, good to know.

Comment 7

[BugBot [:suhaib / :marco/ :calixte]]

There is an r+ patch which didn't land and no activity in this bug for 2 weeks.
:pierov, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 8

[Emilio Cobos Álvarez (:emilio)]

I queued it for landing as per the discussion above. A test for this would still be very nice.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/856a612ce3d5
Apply spoof English to the default detail summary. r=emilio

Comment 10

[Pier Angelo Vendrame]

(In reply to Emilio Cobos Álvarez (:emilio) from comment #8)

I queued it for landing as per the discussion above. A test for this would still be very nice.

Thanks.
I'm redirecting the NI to Tom then, to see if he can give me some advice or guidance for this.

Comment 11

[Tom Ritter [:tjr]]

I am not sure. Conceptually, maybe we could create a test that uses a different locale, then use chrome privileges to reach inside the element (I think it's like ShadowRoot or something with hidden sub-elements?), and ensure you don't see english when the pref is one value and do when it is another? But I can't find a clear example of where we're setting a locale for a test like this - I would think it'd require us to test with a full langpack installed and I don't know if we do that. This was maybe the closest I saw.

Comment 12

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/856a612ce3d5

Comment 13

[Ryan VanderMeulen [:RyanVM]]

[Tracking Requested - why for this release]: Do we want to backport this to ESR115 or is Tor cherry-picking on their end good enough?

Comment 14

[Pier Angelo Vendrame]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #13)

[Tracking Requested - why for this release]: Do we want to backport this to ESR115 or is Tor cherry-picking on their end good enough?

Cherry-picking on our end is good enough for us, no need backport for us, thanks.

Comment 15

[Pier Angelo Vendrame]

We patched all our channels, so this bug can be opened if you want to.
Thanks again!

Comment 16

[Daniel Veditz [:dveditz]]

Sorry for the burst of bugspam: filter on tinkling-glitter-filtrate
Adding reporter-external keyword to security bugs found by non-employees for accounting reasons