859603 - Add "load from URL" button in about:memory

Status: NEW

(Toolkit :: about:memory, defect, P3)

Description

[Nicholas Nethercote [inactive]]

Once bug 848560 lands, gzipped JSON will become the standard form for attaching memory reports to bugs.  As a result, the "read from clipboard" function won't be much use, and we should replace it with "load from URL".

Since it's just JSON I don't think there will be any security concerns, but perhaps we should run this past a security person just to be sure.

Comment 1

[Nicholas Nethercote [inactive]]

Note to self: an XHR is the way to do this.

Comment 2

[Nicholas Nethercote [inactive]]

"Read from clipboard" was removed in bug 1127645. "Load from URL" would still be very useful.

Comment 3

[Daniel Veditz [:dveditz]]

(In reply to Nicholas Nethercote [:njn] from comment #0)
> Since it's just [gzipped] JSON I don't think there will be any security concerns, but
> perhaps we should run this past a security person just to be sure.

Off the top of my head, historically there have been security exploits in gzip implementations and JSON parsers. I'll assume you're using the standard in-tree implementations and not rolling your own, in which case it's at least not additional risk and the standard implementations have had tons of testing.

This feature isn't just a JSON pretty-printer (or is it?): there's additional potential for security bugs in whatever you're doing with the content.

Comment 4

[Nicholas Nethercote [inactive]]

> Off the top of my head, historically there have been security exploits in
> gzip implementations and JSON parsers. I'll assume you're using the standard
> in-tree implementations and not rolling your own, in which case it's at
> least not additional risk and the standard implementations have had tons of
> testing.

Correct, the feature would use the in-tree ones: nsGzipConverter and JSON.parse. In fact, those things are already in use because we've supported the ability to load these files from local disk for a long time. This bug is just about letting you load from a specified URL as well, the motivation being that we often save memory report files from bug reports and then load them locally, and this feature would just streamline that use case.

> This feature isn't just a JSON pretty-printer (or is it?): there's
> additional potential for security bugs in whatever you're doing with the
> content.

It *is* just a JSON pretty-printer.