1936336 - Disallow inline event handlers in browser.xhtml in debug builds (and test)

Status: RESOLVED FIXED

(Firefox :: General, task)

Description

[Tom Schuster (MoCo)]

After we have removed all inline event handlers from browser.xhtml we should add something like this to its HTML:

#ifdef NIGHTLY_BUILD
  <meta http-equiv="Content-Security-Policy" content="script-src-attr 'self'" />
#endif

Additionally we should have some kind of test that ensures that e.g. using setAttribute("onclick") on the browser is correctly blocked.

Comment 1

[Tom Schuster (MoCo)]

Attachment: Bug 1936336 - Disallow inline event handlers in browser.xhtml in debug builds (and test). r?freddyb!,Gijs!

Comment 2

[Tom Schuster (MoCo)]

Big try push

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4f1ddec217ba
Disallow inline event handlers in browser.xhtml in debug builds (and test). r=freddyb,Gijs

Comment 5

[amarc]

Backed out for causing bc failures @ browser_policy_managedbookmarks.js

• Backout link
• Push with failures
• Failure Log
• Failure line:

TEST-UNEXPECTED-FAIL | browser/components/enterprisepolicies/tests/browser/managedbookmarks/browser_policy_managedbookmarks.js | Uncaught exception in test bound test_policy_managedbookmarks - at chrome://mochitests/content/browser/browser/components/enterprisepolicies/tests/browser/managedbookmarks/browser_policy_managedbookmarks.js:35 - TypeError: can't access property "label", managedBookmarksMenu.menupopup.children[0] is undefined

Comment 6

[Tom Schuster (MoCo)]

Bug 1938883

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/c84982de770a
Disallow inline event handlers in browser.xhtml in debug builds (and test). r=freddyb,Gijs

Comment 8

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/c84982de770a