Bug 1708384 - Properly hide -moz-context-properties from content. r=dholbert

Depends on D114481

Differential Revision: https://phabricator.services.mozilla.com/D114482
This commit is contained in:
Emilio Cobos Álvarez 2021-05-12 21:45:18 +00:00
parent 41179cf5d6
commit 9e80cd9710
11 changed files with 114 additions and 115 deletions

View File

@ -35,7 +35,7 @@ let whitelist = [
isFromDevTools: false,
},
{
sourceName: /\b(minimal-xul|html|mathml|ua|forms|svg)\.css$/i,
sourceName: /\b(minimal-xul|html|mathml|ua|forms|svg|manageDialog|autocomplete-item-shared|formautofill)\.css$/i,
errorMessage: /Unknown property.*-moz-/i,
isFromDevTools: false,
},

View File

@ -674,20 +674,6 @@ exports.CSS_PROPERTIES = {
"unset"
]
},
"-moz-context-properties": {
"isInherited": true,
"subproperties": [
"-moz-context-properties"
],
"supports": [],
"values": [
"inherit",
"initial",
"none",
"revert",
"unset"
]
},
"-moz-float-edge": {
"isInherited": false,
"subproperties": [
@ -11001,6 +10987,10 @@ exports.PREFERENCES = [
"justify-tracks",
"layout.css.grid-template-masonry-value.enabled"
],
[
"-moz-context-properties",
"svg.context-properties.content.enabled"
],
[
"offset-anchor",
"layout.css.motion-path.enabled"

View File

@ -44,13 +44,7 @@ class Alias(object):
def is_internal(prop):
# A property which is not controlled by pref and not enabled in
# content by default is an internal property.
if not prop.gecko_pref and not prop.enabled_in_content():
return True
# There are some special cases we may want to remove eventually.
OTHER_INTERNALS = [
"-moz-context-properties",
]
return prop.name in OTHER_INTERNALS
return not prop.gecko_pref and not prop.enabled_in_content()
def method(prop):
if prop.name == "float":

View File

@ -93,7 +93,6 @@ const char* gInaccessibleProperties[] = {
"-x-lang",
"-x-span",
"-x-text-zoom",
"-moz-context-properties",
"-moz-default-appearance",
"-moz-inert",
"-moz-list-reversed", // parsed by UA sheets only

View File

@ -25,6 +25,7 @@ const NON_CONTENT_ACCESSIBLE_PROPERTIES = [
"-moz-default-appearance",
"-moz-inert",
"-moz-control-character-visibility",
"-moz-context-properties",
];
const sheet = document.getElementById("sheet");

View File

@ -1,7 +1,8 @@
[DEFAULT]
[test_disabled_chrome.html]
support-files =
svg_example_test.html
svg_example_script.svg
[test_disabled_chrome.html]
[test_context_properties_allowed_domains.html]
support-files =
file_context_fill_fallback_red.html

View File

@ -9,4 +9,9 @@
fill: green;
}
</style>
<img src="file_context_fill_fallback_red.svg" style="width: 100px; height: 100px;">
<img style="width: 100px; height: 100px;">
<script>
let domain = location.search.substring(1);
let img = document.querySelector("img");
img.src = img.alt = `http://${domain}/tests/layout/svg/tests/file_context_fill_fallback_red.svg`;
</script>

View File

@ -1,11 +1,8 @@
[DEFAULT]
support-files =
file_disabled_iframe.html
[test_context_properties_allowed_domains.html]
support-files =
file_context_fill_fallback_red.html
file_context_fill_fallback_red.svg
[test_disabled.html]
[test_embed_sizing.html]
support-files =

View File

@ -1,86 +1,95 @@
<head>
<meta charset="utf-8">
<title>Bug 1699892 - SVG context properties for allowed domains</title>
<script src="/tests/SimpleTest/SimpleTest.js"></script>
<script src="/tests/SimpleTest/WindowSnapshot.js"></script>
<link rel="stylesheet" href="/tests/SimpleTest/test.css"/>
<script>
/**
* Returns a Promise that resolves when target fires a load event.
*/
function waitForLoad(target) {
return new Promise(resolve => {
target.addEventListener("load", () => {
if (event.target == target) {
resolve();
}}, { once: true });
});
}
/**
* Creates an iframe, loads src in it, and waits for the load event
* for the iframe to fire. Then it snapshots the iframe and returns
* the snapshot (and removes the iframe from the document, to clean up).
*
* src can be a URL starting with http, or is otherwise assumed to be
* a srcdoc string.
*/
async function loadSrcImageAndSnapshot(src) {
let frame = document.createElement("iframe");
document.body.appendChild(frame);
if (!src.startsWith("http")) {
frame.srcdoc = src;
} else {
frame.src = src;
}
await waitForLoad(frame);
let snapshot = await snapshotWindow(frame, false);
document.body.removeChild(frame);
return snapshot;
}
add_task(async () => {
const ALLOWED_DOMAIN = "example.org";
const DISALLOWED_DOMAIN = "example.com";
const CONTEXT_FILL_SVG = "tests/layout/svg/tests/file_context_fill_fallback_red.html";
const ALLOWED = `http://${ALLOWED_DOMAIN}/${CONTEXT_FILL_SVG}`;
const DISALLOWED = `http://${DISALLOWED_DOMAIN}/${CONTEXT_FILL_SVG}`;
await SpecialPowers.pushPrefEnv({
set: [["svg.context-properties.content.allowed-domains", ALLOWED_DOMAIN]]
});
// When the context properties are allowed, we expect a green
// square. When they are not allowed, we expected a red square.
let redReference = await loadSrcImageAndSnapshot(
`<div style="width: 100px; height: 100px; background: red"></div>`
);
let greenReference = await loadSrcImageAndSnapshot(
`<div style="width: 100px; height: 100px; background: green"></div>`
);
let allowedSnapshot = await loadSrcImageAndSnapshot(ALLOWED);
let disallowedSnapshot = await loadSrcImageAndSnapshot(DISALLOWED);
const kNoFuzz = null;
info("Reference snapshots should look different from each other");
assertSnapshots(redReference, greenReference, false, kNoFuzz, "red", "green");
info("Allowed domain should be green");
assertSnapshots(allowedSnapshot, greenReference, true, kNoFuzz, ALLOWED, "green");
info("Disallowed domain should be red");
assertSnapshots(disallowedSnapshot, redReference, true, kNoFuzz, DISALLOWED, "red");
<!doctype html>
<meta charset="utf-8">
<title>Bug 1699892 - SVG context properties for allowed domains</title>
<script src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
<script src="chrome://mochikit/content/tests/SimpleTest/WindowSnapshot.js"></script>
<script>
/**
* Returns a Promise that resolves when target fires a load event.
*/
function waitForLoad(target) {
return new Promise(resolve => {
target.addEventListener("load", () => {
if (event.target == target) {
resolve();
}}, { once: true });
});
</script>
</head>
}
function makeContextFillFrame(source) {
return `
<style>
img {
-moz-context-properties: fill;
fill: green;
}
</style>
<img src="${source}" style="width: 100px; height: 100px;">
`;
}
/**
* Creates an iframe, loads src in it, and waits for the load event
* for the iframe to fire. Then it snapshots the iframe and returns
* the snapshot (and removes the iframe from the document, to clean up).
*
* src can be a URL starting with http, or is otherwise assumed to be
* a srcdoc string.
*/
async function loadSrcImageAndSnapshot({ src, srcdoc }) {
let frame = document.createElement("iframe");
document.body.appendChild(frame);
if (src) {
frame.src = src;
} else {
frame.srcdoc = srcdoc;
}
await waitForLoad(frame);
let snapshot = await snapshotWindow(frame, false);
document.body.removeChild(frame);
return snapshot;
}
add_task(async () => {
const ALLOWED_DOMAIN = "example.org";
const DISALLOWED_DOMAIN = "example.com";
await SpecialPowers.pushPrefEnv({
set: [["svg.context-properties.content.allowed-domains", ALLOWED_DOMAIN]]
});
// When the context properties are allowed, we expect a green
// square. When they are not allowed, we expected a red square.
let redReference = await loadSrcImageAndSnapshot({
srcdoc: `<div style="width: 100px; height: 100px; background: red"></div>`,
});
let greenReference = await loadSrcImageAndSnapshot({
srcdoc: `<div style="width: 100px; height: 100px; background: green"></div>`,
});
let allowedSnapshot = await loadSrcImageAndSnapshot({
src: `file_context_fill_fallback_red.html?${ALLOWED_DOMAIN}`
});
let disallowedSnapshot = await loadSrcImageAndSnapshot({
src: `file_context_fill_fallback_red.html?${DISALLOWED_DOMAIN}`
});
const kNoFuzz = null;
info("Reference snapshots should look different from each other");
assertSnapshots(redReference, greenReference, false, kNoFuzz, "red", "green");
info("Allowed domain should be green");
assertSnapshots(allowedSnapshot, greenReference, true, kNoFuzz, ALLOWED_DOMAIN, "green");
info("Disallowed domain should be red");
assertSnapshots(disallowedSnapshot, redReference, true, kNoFuzz, DISALLOWED_DOMAIN, "red");
});
</script>
<body>
</body>
</html>

View File

@ -10486,7 +10486,7 @@
# keywords are currently not part of any spec, which is partly why we disable
# them for web content.
- name: svg.context-properties.content.enabled
type: bool
type: RelaxedAtomicBool
value: false
mirror: always

View File

@ -209,6 +209,9 @@ ${helpers.predefined_type(
"MozContextProperties",
"computed::MozContextProperties::default()",
engines="gecko",
enabled_in="chrome",
gecko_pref="svg.context-properties.content.enabled",
has_effect_on_gecko_scrollbars=False,
animation_value_type="none",
spec="Nonstandard (https://developer.mozilla.org/en-US/docs/Web/CSS/-moz-context-properties)",
)}