2049489 - Render the Daily Crossword in a sandboxed iframe

Status: RESOLVED FIXED

(Firefox :: New Tab Page, enhancement)

Description

[Maxx Crawford [:maxx]]

Render the crossword bundle (served via Merino) inside a sandboxed iframe within the widget article.

• <iframe sandbox="allow-scripts"> (no allow-same-origin) inside <article className="widget">; loading spinner + error/"Try again" states.
• Add frame-src <merino-origin> to the newtab CSP meta tag in prerendered/activity-stream.html (no frame-src exists today, so default-src 'none' currently blocks all iframes).
• Add a configurable Merino endpoint pref (following the pattern from the World Cup Widget), defaulting to the staging endpoint https://stage-games-particle.merino.nonprod.webservices.mozgcp.net/index.html, routed through a resolve* helper that applies trainhopConfig overrides (never read the raw pref). The iframe src reads the resolved value so we can swap staging to prod and trainhop-target it.

Additional notes:

• No client-side caching or puzzle feed in v1: The iframe self-fetches its own puzzle data
• Merino plus the browser HTTP cache handle bundle versioning.

Sample Merino endpoint: https://stage-games-particle.merino.nonprod.webservices.mozgcp.net/index.html

Comment 1

[Reem Hamoui]

Attachment: Bug 2049489 - Add in Particle iframe for crosswords widget. r=#home-newtab-reviewers

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/f59a7d9f7704
https://hg.mozilla.org/integration/autoland/rev/5452164087d0
Add in Particle iframe for crosswords widget. r=maxx

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/9ff04418a75a
https://hg.mozilla.org/integration/autoland/rev/822bf4207870
Revert "Bug 2049489 - Add in Particle iframe for crosswords widget. r=maxx" for causingg multiple failures on nsContentSecurityUtils.cpp

Comment 4

[rperta]

Backed out for causingg multiple failures on nsContentSecurityUtils.cpp
Backout link
Push with failures
Failure log(s)

Comment 5

[Reem Hamoui]

The failure log isn't really indicating what the "unexpected exception" is, would you be able to tell me what the error is?

edit: sorry i found it shortly after but forgot to update this comment

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/6c4631424b7a
https://hg.mozilla.org/integration/autoland/rev/3a0c9bd20a7a
Add in Particle iframe for crosswords widget. r=maxx,tschuster

Comment 7

[Maxx Crawford [:maxx]]

Attachment: Bug 2049489 - Allow frame-src https host sources for the New Tab crossword widget in about:home/about:newtab CSP checks. r=tschuster

Comment 8

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: New tab will not be able to experiment with the Crossword widget in the en-US market
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: Follow steps in https://phabricator.services.mozilla.com/D309189
• Risk associated with taking this patch: low
• Explanation of risk level: The feature that would use this code change is behind a pref (and off by default)
• String changes made/needed?: No
• Is Android affected?: no

Comment 9

[Maxx Crawford [:maxx]]

Note that I created a revision for the dom/security/nsContentSecurityUtils.cpp changes to be uplifted to maintain train-hop compatibility.

https://lando.moz.tools/D311311/

Comment 10

[Maxx Crawford [:maxx]]

Attachment: Bug 2049489 - Allow frame-src https host sources for the New Tab crossword widget in about:home/about:newtab CSP checks. r=tschuster

Comment 11

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: New tab will not be able to experiment with the Crossword widget in the en-US market
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: Follow steps in https://phabricator.services.mozilla.com/D309189
• Risk associated with taking this patch: low
• Explanation of risk level: The feature that would use this code change is behind a pref (and off by default)
• String changes made/needed?: No
• Is Android affected?: no

Comment 12

[Maxx Crawford [:maxx]]

Attachment: Bug 2049489 - Allow frame-src https host sources for the New Tab crossword widget in about:home/about:newtab CSP checks.

Original Revision: https://phabricator.services.mozilla.com/D311311

Comment 13

[pstanciu]

https://hg.mozilla.org/mozilla-central/rev/3a0c9bd20a7a

Comment 14

[Maxx Crawford [:maxx]]

Attachment: Bug 2049489 - Allow frame-src https host sources for the New Tab crossword widget in about:home/about:newtab CSP checks.

Original Revision: https://phabricator.services.mozilla.com/D311311

Comment 15

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: New tab will not be able to experiment with the Crossword widget in the en-US market
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: yes
• Steps to reproduce for manual QE testing: Follow steps in https://phabricator.services.mozilla.com/D309189
• Risk associated with taking this patch: low
• Explanation of risk level: The feature that would use this code change is behind a pref (and off by default)
• String changes made/needed?: No
• Is Android affected?: no

Comment 16

[Maxx Crawford [:maxx]]

Attachment: Bug 2049489 - Allow frame-src https host sources for the New Tab crossword widget in about:home/about:newtab CSP checks.

Original Revision: https://phabricator.services.mozilla.com/D311311