Closed Bug 1954706 Opened 1 year ago Closed 1 year ago

CSP violation style-src-attr in devtools/content/inspector/markup/markup.xhtml

Categories

(DevTools :: Inspector, defect)

Product:
DevTools
Component:
Inspector
Type:
defect

Tracking

(firefox-esr128 unaffected, firefox136 unaffected, firefox137 fixed, firefox138 fixed)

Status:
RESOLVED FIXED
Milestone:
138 Branch
Tracking Flags:
Tracking Status
firefox-esr128 --- unaffected
firefox136 --- unaffected
firefox137 --- fixed
firefox138 --- fixed

People

(Reporter: tschuster, Assigned: tschuster)

References

(Regression)

Details

(Keywords: regression)

Attachments

(2 files)

Bug 1954706 - Allow inline styles in inspector/markup/markup.xhtml. r?#devtools-reviewers,bomsy
48 bytes, text/x-phabricator-request
pascalc
: approval-mozilla-beta-
Details | Review
Bug 1954706 - Beta: Allow inline styles in inspector/markup/markup.xhtml. r?#devtools-reviewers
48 bytes, text/x-phabricator-request
pascalc
: approval-mozilla-beta+
Details | Review

chrome://devtools/content/shared/sourceeditor/codemirror/codemirror.bundle.js seems to use inline styles in the context of markup.xhtml, which is now blocked.

Component: General → Inspector

Set release status flags based on info from the regressing bug 1943360

status-firefox136: --- → unaffected
status-firefox137: --- → affected
status-firefox138: --- → affected
status-firefox-esr128: --- → unaffected
Assignee: nobody → tschuster
Status: NEW → ASSIGNED
Pushed by tschuster@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/5bc73b9b2a6f Allow inline styles in inspector/markup/markup.xhtml. r=devtools-reviewers,nchevobbe

https://hg.mozilla.org/mozilla-central/rev/5bc73b9b2a6f

Status: ASSIGNED → RESOLVED
Closed: 1 year ago
status-firefox138: affected → fixed
Resolution: --- → FIXED
Target Milestone: --- → 138 Branch
Blocks: 1940445

Comment on attachment 9472707 [details]
Bug 1954706 - Allow inline styles in inspector/markup/markup.xhtml. r?#devtools-reviewers,bomsy

Beta/Release Uplift Approval Request

  • User impact if declined/Reason for urgency: Some broken functionality in devtools which was only discovered in the wild via Telemetry.
  • Is this code covered by automated tests?: No
  • Has the fix been verified in Nightly?: No
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): This is just weakening a Content Security Policy that previously didn't exist. This allows more potentially "unsafe" things, but gets us back into a working state.
  • String changes made/needed:
  • Is Android affected?: No
Attachment #9472707 - Flags: approval-mozilla-beta?
Attachment #9472707 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Tom, the patch does not graft cleanly to the beta branch, could you rebase your patch for mozilla-beta please? Thanks

Flags: needinfo?(tschuster)
Attachment #9472707 - Flags: approval-mozilla-beta+ → approval-mozilla-beta-
Attachment #9472919 - Flags: approval-mozilla-beta?

Beta patch is there.

Flags: needinfo?(tschuster)
Attachment #9472919 - Flags: approval-mozilla-beta? → approval-mozilla-beta+
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: