879275 - Consider turning off -moz-box display types in untrusted stylesheets

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Boris Zbarsky [:bzbarsky]]

People keep using -moz-box/-webkit-box and then complaining that they render differently.

But why are we giving them this footgun?  Can we just drop support for -moz-box in untrusted stylesheets?  Or are there too many sites that depend on it?  How close are we to unpreffing flexbox?

Comment 1

[Daniel Holbert [:dholbert]]

Flexbox is unpreffed in beta (from bug 841876), and the current plan is to let it stay unpreffed when that goes to release in a few weeks.

> Can we just drop support for -moz-box in untrusted stylesheets?
> Or are there too many sites that depend on it?

I think there might be too many sites...  I suppose we could do analytics to answer that question more definitively ("how many sites use display:-moz-box without following it with display:flex"), if we end up really strongly considering this.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Ah, excellent.  If flexbox is already unpreffed, maybe we should start by adding a warning when -moz-box is used in an untrusted stylesheet?

Comment 3

[Daniel Holbert [:dholbert]]

That might be a good idea.

I suspect there are a lot of sites that have both new and old flexbox, for fallback... And as long as we've got users on old Gecko versions (i.e. until ESR17 and B2G 1.0* have negligible userbases), it'd be unwise to encourage web developers to remove that fallback style.

So if we add a warning like this soon, we'd probably want to only warn if the *computed style* ends up having -moz-box, rather than just if we see -moz-box.

* (I believe B2G 1.0 uses pre-gecko-22, which is before flexbox was preffed on by default)

Comment 4

[Boris Zbarsky [:bzbarsky]]

Computed style is hard because we don't know whether it originated in an untrusted sheet by that point....

Comment 5

[Justin Dolske [:Dolske]]

Is this likely to impact content we ship in Firefox (eg about:home, videocontrols), or is that covered by "trusted stylesheets"? If so we should probably start migrating such things to flexbox. [I suppose there is a similar concern for add-ons too.]

Comment 6

[Boris Zbarsky [:bzbarsky]]

If the stylesheets are loaded from a chrome:// URI (or maybe chrome://content ?), they should be covered by "trusted stylesheets".

But we should start migrating to flexbox anyway.

Comment 7

[phillip.haydon]

Just drop it completely. Stop being the IE6 of the current browsers.

Comment 8

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

(In reply to Boris Zbarsky [:bz] from comment #4)
> Computed style is hard because we don't know whether it originated in an
> untrusted sheet by that point....

We could probably issue the warning in nsCSSCompressedDataBlock::MapRuleInfoInto to get around that problem.

Comment 9

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

work in progress on the warning:
https://hg.mozilla.org/users/dbaron_mozilla.com/patches/raw-file/728ac3ced47c/unapplied.warn-xul-display-types
but putting it aside for now (see TODO at the top)

Comment 10

[Emilio Cobos Álvarez (:emilio)]

This is fixed as of bug 1496961. We don't parse the -moz- display values on content sheets anymore.