459948 - Workers: update workers based on security review feedback

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch

Patch attached.

Comment 1

[Daniel Veditz [:dveditz]]

Pretty vague bug summary :-)

Looks like this does the first three bullets at
https://wiki.mozilla.org/Firefox3.1/Web_Workers_Security_Review#Review_comments
that is, clearing regexp statics on context reuse, asserting attempts to use the stub security manager, and testing recursion.

Don't think the bug needs to be hidden since 1) the issues are public, and 2) this is getting fixed before we've released with the problems.

It'd be nice to get a verification test for clearing the regexp statics, some test that shows bleed-through values before the fix and doesn't after.

Comment 2

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Attachment: Patch, v2

Thanks Dan, Jonas had a similar concern, so here is a patch with an additional test.

Comment 3

[Ben Turner (not reading bugmail, use the needinfo flag!)]

Pushed last night.