369238 - Propagate trust labels through all network loads

Status: RESOLVED INCOMPLETE

(Core Graveyard :: Tracking, defect)

Description

[Boris Zbarsky [:bzbarsky]]

This is a bug to track propagation of trust labels through networks loads.  That means setting the owner of channels as needed.  Unfortunately, we have APIs that don't really allow that (e.g. imagelib APIs).

Also, to do this we'll need to have a way to prevent execution of javascript: with the channel's trust label as needed (to solve content-filtering issues).

I'll file bugs on things as they come up.

Comment 1

[Boris Zbarsky [:bzbarsky]]

As a note, the "right" (thinking Mozilla 2 here) way to do this in my opinion is:

1)  NewURI() calls should require passing in an origin principal for the URI.
2)  NewChannel() calls should start off using the origin principal of the URI but
    allow the user to override with an origin hint.
3)  The channel should be able to override the hint with whatever principal it
    figures out for itself as needed.

Comment 2

[BMO Automation]

Marking all tracking bugs which haven't been updated since 2014 as INCOMPLETE.
If this bug is still relevant, please reopen it and move it into a bugzilla component related to the work
being tracked. The Core: Tracking component will no longer be used.