602212 - Use js.msg when CSP blocks eval

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Comment 1

[Jason Orendorff [:jorendorff]]

I'll fix this in bug 592664 after all.

Comment 2

[Jason Orendorff [:jorendorff]]

Sorry. No coffee yet. Will fix.

Comment 3

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 481245 [details] [diff] [review]
v1

r=me with a double-check that caps isn't double-reporting.

/be

Comment 5

[Jason Orendorff [:jorendorff]]

Do you mean a JS_ASSERT or an actual "if (!cx->throwing)" around the JS_ReportErrorNumber calls?

Comment 6

[Brendan Eich [:brendan]]

(In reply to comment #5)
> Do you mean a JS_ASSERT or an actual "if (!cx->throwing)" around the
> JS_ReportErrorNumber calls?

Or just inspect the caps code (I tried a grep and saw some Report matches, so was not sure). But asserting is better, if JS_ReportErrorNumber doesn't already.

/be

Comment 7

[Tom S [:evilpie]]

Attachment: refreshed

Comment 8

[Jason Orendorff [:jorendorff]]

Comment on attachment 571782 [details] [diff] [review]
refreshed

Confirmed, the hook for this in CAPS (nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction) does not report an error.

Thanks for digging this one up, evilpie.

Comment 9

[Tom S [:evilpie]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/fec0c7e1b84c

Comment 10

[Mounir Lamouri (:mounir)]

https://hg.mozilla.org/mozilla-central/rev/fec0c7e1b84c