509038 - Tweak all_security_filterUnsafeJS() regexs

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Admin/Editor Tools, defect)

Description

[Wil Clouser [:clouserw]]

Two regex's are too broad right now:

/.launch/ and /eval/ should both be trying to match parenthesis afterwards.  Something like /eval\s*\(/.

Comment 1

[Wladimir Palant]

Actually, I wrote /\beval\s*\(/ because matching "eval" at the end of a longer word makes little sense as well - \b makes sure that "eval" is the whole word.

Comment 3

[Philip Chee]

From: https://addons.mozilla.org/en-US/developers/versions/validate/71618

#   chrome/flashblock.jar/content/flashblock/flashblock.css (58) : Matched Pattern: "/-moz-binding:(?!\s*url\s*\(\s*["']?chrome:\/\/.*\/content\/)/"
{ 
-moz-binding: none !important; 
} 

Also how about resource urls?

Comment 4

[Dave Townsend [:mossop]]

(In reply to comment #3)
> From: https://addons.mozilla.org/en-US/developers/versions/validate/71618
> 
> #   chrome/flashblock.jar/content/flashblock/flashblock.css (58) : Matched
> Pattern: "/-moz-binding:(?!\s*url\s*\(\s*["']?chrome:\/\/.*\/content\/)/"
> { 
> -moz-binding: none !important; 
> } 
> 
> Also how about resource urls?

resource urls can point to http as I recall so they should still be flagged

Comment 5

[RJ Walsh [:rjwalsh]]

Attachment: Tweaks to regexes and tests

Comment 6

[RJ Walsh [:rjwalsh]]

Fixed in r48781