682167 - option(s) to create empty sandbox

Status: RESOLVED INACTIVE

(Core :: XPConnect, defect)

Description

[Dave Herman [:dherman]]

The sandbox library forces you to share a global Components variable/property. It would be good to make it possible for Jetpack to move towards restricting access to XPCOM, and the Harmony module loaders will probably also need the ability to run code with no access to Components.

Apparently there are currently assertions that assume that Components is available, but hopefully we can eliminate those assertions and add an option to Components.utils.Sandbox to allow creating a sandbox with no global Components variable.

It might also be good to make it possible to eliminate the .dump, .debug, and .importFunction properties.

Dave

Comment 1

[Gabor Krizsanits (INACTIVE)]

This bug reminds me to bug 636145. How much is different what we want here? I can probably find and turn off the piece of code that inits the Components on the new scope and can look into the others, just wondering if this is not a duplicate of the other bug.

Comment 2

[Dave Herman [:dherman]]

Good point made by Alex in the Jetpack meeting: even if we eliminate .Components, it's pretty easy for it to be leaked anyway, because the window object is reachable from many DOM elements, and the window object has a .Components property.

So the more important way to close the leak is to run Jetpacks with low principals. Nevertheless, it's still a good idea not to pollute the global namespace with it, or to unnecessarily leak the reference.

Dave

Comment 3

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.