1990732 - Trusted Types policies should not apply to isolated WebExtension content scripts - part 3

Status: NEW

(Core :: DOM: Security, enhancement)

Description

[Frédéric Wang Nélar]

Followup of bug 1947732 and 1986632, covering eval/new Function in workers.

Comment 1

[Frédéric Wang Nélar]

https://phabricator.services.mozilla.com/D263688#9192876

Comment 2

[Frédéric Wang Nélar]

(In reply to Frédéric Wang (:fredw) from comment #0)

Followup of bug 1947732 and 1986632, covering eval/new Function in workers.

Just to be clear, I was referring to this part where we pass nullptr as a subject principal: https://searchfox.org/firefox-main/rev/955360e8e3a773601c56f08069449d8d9261b873/dom/workers/RuntimeService.cpp#532 ; see https://phabricator.services.mozilla.com/D263688?id=1123549#inline-1454737 for discussion about how to handle this case.

Other cases handled by [NeedsSubjectPrincipal=NonSystem] but not tested:

• ServiceWorkerContainer.register
• WindowOrWorkerGlobalScope.setTimeout / setInterval
• WorkerGlobalScope.importScripts

Other cases where we can't use [NeedsSubjectPrincipal=NonSystem]:

• SharedWorker/Worker constructors (bug 1963277)

Comment 3

[Frédéric Wang Nélar]

Attachment: WIP: Bug 1990732 - Add worker tests in test_ext_contentscript_trustedtypes.js

Comment 4

[Phabricator Automation]

Comment on attachment 9517090 [details]
WIP: Bug 1990732 - Add worker tests in test_ext_contentscript_trustedtypes.js

Revision D266758 was moved to bug 1991623. Setting attachment 9517090 [details] to obsolete.