Bug 1450315 - Remove document.allowUnsafeHTML. r=bz

This attribute was added in bug 1432966 when we started sanitizing
chrome usage of innerHTML to allow devtools to use custom attributes
in React via dangerouslySetInnerHTML.

Devtools removed its usage of dangerouslySetInnerHTML in bug 1434155, so
document.allowUnsafeHTML is no longer used and can be removed.

MozReview-Commit-ID: 8xTVZDmPqRa

--HG--
extra : rebase_source : 3d427133ccb8975163b4459af57b5d96ef54c93e

dom/base/nsContentUtils.cpp

@@ -5091,7 +5091,8 @@ nsContentUtils::ParseFragmentHTML(const nsAString& aSourceBuffer,
   // If this is a chrome-privileged document, create a fragment first, and
   // sanitize it before insertion.
   RefPtr<DocumentFragment> fragment;
-  if (aSanitize != NeverSanitize && !aTargetNode->OwnerDoc()->AllowUnsafeHTML()) {
+  if (aSanitize != NeverSanitize &&
+      IsSystemPrincipal(aTargetNode->NodePrincipal())) {
     fragment = new DocumentFragment(aTargetNode->OwnerDoc()->NodeInfoManager());
     target = fragment;
   }
@@ -5198,7 +5199,8 @@ nsContentUtils::ParseFragmentXML(const nsAString& aSourceBuffer,
 
   // If this is a chrome-privileged document, sanitize the fragment before
   // returning.
-  if (aSanitize != NeverSanitize && !aDocument->AllowUnsafeHTML()) {
+  if (aSanitize != NeverSanitize &&
+      IsSystemPrincipal(aDocument->NodePrincipal())) {
     // Don't fire mutation events for nodes removed by the sanitizer.
     nsAutoScriptBlockerSuppressNodeRemoved scriptBlocker;
 

dom/base/nsDocument.cpp

@@ -1434,7 +1434,6 @@ nsIDocument::nsIDocument()
     mEncodingMenuDisabled(false),
     mIsShadowDOMEnabled(false),
     mIsSVGGlyphsDocument(false),
-    mAllowUnsafeHTML(false),
     mInDestructor(false),
     mIsGoingAway(false),
     mInXBLUpdate(false),
@@ -5862,13 +5861,6 @@ nsIDocument::CreateAttributeNS(const nsAString& aNamespaceURI,
   return attribute.forget();
 }
 
-bool
-nsIDocument::AllowUnsafeHTML() const
-{
-  return (!nsContentUtils::IsSystemPrincipal(NodePrincipal()) ||
-          mAllowUnsafeHTML);
-}
-
 void
 nsIDocument::ResolveScheduledSVGPresAttrs()
 {

dom/base/nsIDocument.h

@@ -3211,8 +3211,6 @@ public:
     CreateAttributeNS(const nsAString& aNamespaceURI,
                       const nsAString& aQualifiedName,
                       mozilla::ErrorResult& rv);
-  void SetAllowUnsafeHTML(bool aAllow) { mAllowUnsafeHTML = aAllow; }
-  bool AllowUnsafeHTML() const;
   void GetInputEncoding(nsAString& aInputEncoding) const;
   already_AddRefed<mozilla::dom::Location> GetLocation() const;
   void GetReferrer(nsAString& aReferrer) const;
@@ -4044,10 +4042,6 @@ protected:
   // True if this document is for an SVG-in-OpenType font.
   bool mIsSVGGlyphsDocument : 1;
 
-  // True if unsafe HTML fragments should be allowed in chrome-privileged
-  // documents.
-  bool mAllowUnsafeHTML : 1;
-
   // True if the document is being destroyed.
   bool mInDestructor: 1;
 

dom/webidl/Document.webidl

@@ -106,11 +106,6 @@ interface Document : Node {
   Attr createAttribute(DOMString name);
   [NewObject, Throws]
   Attr createAttributeNS(DOMString? namespace, DOMString name);
-
-  // Allows setting innerHTML without automatic sanitization.
-  // Do not use this.
-  [ChromeOnly]
-  attribute boolean allowUnsafeHTML;
 };
 
 // https://html.spec.whatwg.org/multipage/dom.html#the-document-object