2014254 - WindowGlobalParent: don't get securityInfo from content process

Status: RESOLVED DUPLICATE of bug 2022249

(Core :: DOM: Content Processes, enhancement)

Description

[Dana Keeler (she/her) [:keeler]]

WindowGlobalParent currently gets its securityInfo from the content process via RecvUpdateDocumentSecurityInfo. This is not great from a security perspective, because if the content process gets compromised, the parent process is trusting potentially malicious information.

Comment 1

[Dana Keeler (she/her) [:keeler]]

Attachment: Bug 2014254 - have DocumentLoadListener set WindowGlobalParent's securityInfo r?smaug

This avoids trusting the content process for this information. It also removes
an IPC call.

Comment 3

[Daniel Veditz [:dveditz]]

bug 1670242 might not be quite the right fission meta bug to block, but it's in the ballpark of known and ongoing efforts.