2068934 - Sanitizer API: javascript URL handling should be part of the config

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement)

Description

[Noam Rosenthal]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36

Steps to reproduce:

See https://github.com/whatwg/html/pull/12898

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::DOM: Security' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[mtan]

Attachment: Bug 2068934 - Support javascriptURLs in the configuration of sanitizer. r=tschuster,emilio

When javascriptURLs is set to false, unsafe methods will remove javascript URLs from the input.

In Safe methods javascript URLs always be removed regardless of config.

Implements https://github.com/whatwg/html/pull/12898

WPT: https://github.com/web-platform-tests/wpt/pull/62421

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/b590a088bc73
https://hg.mozilla.org/integration/autoland/rev/fa0eea47cef9
Support javascriptURLs in the configuration of sanitizer. r=tschuster,webidl,smaug,keithamus

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/19edd9c685cb
https://hg.mozilla.org/integration/autoland/rev/f46ff0e93d7f
Revert "Bug 2068934 - Support javascriptURLs in the configuration of sanitizer. r=tschuster,webidl,smaug,keithamus" for causing wpt failures @Sanitizer.cpp.

Comment 5

[Goloman Adrian[:agoloman]]

Backed out for causing wpt failures @Sanitizer.cpp.

• Backout link
• Push with failures
• Failure Log @sanitizer-javascript-url.html
• Failure log @sanitizer-config.html
• Failure Log @Sanitizer.cpp

Comment 6

[Tom Schuster [:tschuster]]

./mach try auto https://treeherder.mozilla.org/jobs?repo=try&landoInstance=lando-prod-2025&landoCommitID=91437

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/55c2874c6973
https://hg.mozilla.org/integration/autoland/rev/4ea3045980a2
Support javascriptURLs in the configuration of sanitizer. r=tschuster,webidl,smaug,keithamus

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/d1c4c600e21f
https://hg.mozilla.org/integration/autoland/rev/503330b78094
delete sanitizer-javascript-url.html.ini manifest because test are passing r=mtan

Comment 9

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/4ea3045980a2
https://hg.mozilla.org/mozilla-central/rev/503330b78094

Comment 10

[mtan]

clear needinfo.