769052 - SecReview: make tab strip async

Status: RESOLVED INVALID

(mozilla.org :: Security Assurance: Review Request, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

SecReview tracking bug
Actions regarding the review of the dependent bug should be tracked here.

Comment 1

[Jesse Ruderman]

My concern is the same as Gavin's in bug 743069 comment 1: the tab strip, URL bar, and content becoming out of sync for long enough to pose a spoofing risk.

Comment 2

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

sec-review? canceled on parent bug, do we need to keep this bug?
Assigning back to Jesse to either close this bug as we don't need it or do the review.

Comment 3

[Jesse Ruderman]

I have no idea how to audit for that kind of problem.  It could involve complex interactions between tab strip code (e.g. bug 743069, bug 790567) and code elsewhere.  Not to mention the possibility of web pages breaking chrome JS (bug 611123, bug 732665) or content painting (bug 334359).

Comment 4

[Daniel Veditz [:dveditz]]

(In reply to Curtis Koenig [:curtisk] from comment #2)
> sec-review? canceled on parent bug, do we need to keep this bug?

I thought we didn't necessarily need the sec-review? on the parent bug if we had an explicit "review request" bug to cover it (to avoid double-counting requests).

Comment 5

[Mark Goodwin [:mgoodwin]]

No one is working on this; changing to unconfirmed until things start up again.