824172 - Re-enable security.fileuri.strict_origin_policy

Status: RESOLVED FIXED

(Firefox OS Graveyard :: General, defect)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

http://mxr.mozilla.org/mozilla-central/source/b2g/app/b2g.js#361

This opens new potential holes in the gecko VM, but doesn't affect the OS security model.

Comment 1

[Lawrence Mandel [:lmandel] (use needinfo)]

Chris, the comment in b2g.js that you reference states

"Remove me when we have installable apps or wifi support."

Are we ready to revert this pref now?

Comment 2

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

We flipped that pref over a year ago when gaia dev was done primarily over file://.  That hasn't been possible for a long time, and we do have wifi and installable apps now.

Comment 3

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Attachment: Re-enable strict file:// security, because yes we have wifi and installed apps now

Comment 4

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Comment on attachment 695844 [details] [diff] [review]
Re-enable strict file:// security, because yes we have wifi and installed apps now

Review of attachment 695844 [details] [diff] [review]:
-----------------------------------------------------------------

This is the right thing to do, but I don't think it'll actually affect B2G in any way. It only affects pages which have a file:// URL and I don't think that we have any of those.

Hmm.. That does bring up a good question, I wonder what security checks we do for URLs loaded through <iframe mozbrowser>. That's fodder for a separate bug though.

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

https://hg.mozilla.org/integration/mozilla-inbound/rev/5e425fc7bf37

Comment 6

[Graeme McCutcheon [:graememcc]]

https://hg.mozilla.org/mozilla-central/rev/5e425fc7bf37

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/0687a40d2076
https://hg.mozilla.org/releases/mozilla-b2g18/rev/4c0b7ae362ba