783057 - Contacts API exposes raw JS objects to content via find

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bobby Holley (:bholley)]

This breaks when we start denying access to chrome objects without __exposedProps__. Patch coming up to fix the issue.

Comment 1

[Bobby Holley (:bholley)]

Attachment: Expose find results via XPCOM. v1

Attaching a patch. Gregor, if you're unsatisfied with the performance here, can you take
responsibility for fix the API as necessary so that it works with mandatory __exposedProps__?
I want to land this stuff ASAP before more insecure APIs arrive on m-c.

Comment 2

[Bobby Holley (:bholley)]

Thanks Gregor.

I manually ran the contact tests (since there aren't so many of them) in order to reduce try load. Pushed to m-i:

https://hg.mozilla.org/integration/mozilla-inbound/rev/6d1deb480cfd

Comment 3

[Gregor Wagner [:gwagner]]

I just did the performance test:
loading 500 contacts without this patch: 2.1 - 2.6 sec
with this patch: 3.5 - 4 sec :(
I guess we have to fix it with __exposedProps__
I will file a followup

Comment 4

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/6d1deb480cfd

Comment 5

[Reuben Morais [:reuben]]

(In reply to Gregor Wagner [:gwagner] from comment #3)
> I just did the performance test:
> loading 500 contacts without this patch: 2.1 - 2.6 sec
> with this patch: 3.5 - 4 sec :(
> I guess we have to fix it with __exposedProps__
> I will file a followup

Is this still the case? We might be able to shave off a few seconds off the loading time for getAll if we can fix this performance regression.