Commit Graph

1215 Commits

Author SHA1 Message Date
Bogdan Tara
745a1d73ea Merge mozilla-central to mozilla-inbound. a=merge CLOSED TREE 2019-08-15 01:06:23 +03:00
Tom Ritter
097aa52411 Bug 1573622 - Do not enforce eval() assertions if userchrome.css is enabled r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D41814

--HG--
extra : moz-landing-system : lando
2019-08-14 14:29:57 +00:00
Sebastian Streich
d9aecc626c Bug 1570658 - Add a Flag for Navigation-Nosniff r=ckerschb
***
Revert Changes to Test

Differential Revision: https://phabricator.services.mozilla.com/D40618

--HG--
extra : moz-landing-system : lando
2019-08-14 07:07:33 +00:00
Christoph Kerschbaumer
f5df74c740 Bug 1573145: Create ContentSecurityUtils.h/cpp and move AssertAboutPageHasCSP into it. r=jkt
Differential Revision: https://phabricator.services.mozilla.com/D41537

--HG--
extra : moz-landing-system : lando
2019-08-14 10:15:09 +00:00
Jan Andre Ikenmeyer
e92e3d02f6 Bug 1560699 - Download FTP resources instead of rendering them. r=michal
Differential Revision: https://phabricator.services.mozilla.com/D39702

--HG--
extra : moz-landing-system : lando
2019-08-11 20:46:06 +00:00
Andrew McCreight
c706a636a8 Bug 1559489, part 4 - Remote-to-local window transplanting. r=tcampbell,bzbarsky
This patch cleans up remote outer window proxies when we navigate back
into the process.

It adds a flag to mDanglingRemoteOuterProxies that is set in between
BrowsingContext::SetDocShell(), where we can tell that the browsing
context is going from being remote to being local, to
nsGlobalWindowOuter::SetNewDocument(), where the local outer window
proxy is actually created. Once the outer window is created, the
remote window proxies can be cleaned up in
CleanUpDanglingRemoteOuterWindowProxies().

The clean up is done by a process that is similar to object
transplanting, except that instead of looking in the cross-compartment
wrapper table for each compartment to find objects to be turned into
CCWs to the new object, it looks in the remote proxy map for each
compartment. SpiderMonkey doesn't know about the proxy maps, so this
has to be done by a new callback object CompartmentTransplantCallback.

Now that this cleanup is being done, it shouldn't be possible to wrap
a remote outer window proxy when the browsing context is local, so
MaybeWrapWindowProxy() can be simplified. I had to drop the assert
here that the browsing context has a window proxy because during clean
up we call wrap on a local outer window proxy before the BC gets the
window proxy set on it. I had the assert because my original plan was
to implicitly fix remote proxies during wrapping, but that is no
longer necessary.

Differential Revision: https://phabricator.services.mozilla.com/D38343

--HG--
extra : moz-landing-system : lando
2019-08-13 19:09:59 +00:00
Sebastian Streich
abdca609f0 Bug 1567059 - Add test for CSP and Bookmarklet interaction r=ckerschb,bzbarsky
Differential Revision: https://phabricator.services.mozilla.com/D40652

--HG--
extra : moz-landing-system : lando
2019-08-06 19:44:05 +00:00
Christoph Kerschbaumer
c515db9854 Bug 1573134: Inline evalAllowList within AssertEvalNotRestricted. r=jkt
Differential Revision: https://phabricator.services.mozilla.com/D41529

--HG--
extra : moz-landing-system : lando
2019-08-13 11:59:11 +00:00
Cosmin Sabou
f134fff740 Bug 1571698 - Annotate tests that also crash on opt builds. r=kmag
Differential Revision: https://phabricator.services.mozilla.com/D41459

--HG--
extra : moz-landing-system : lando
2019-08-10 00:45:51 +00:00
Kannan Vijayan
e53a880b1c Bug 1569262 - Rename nsIDocShellTreeItem::GetRootTreeItem to GetInProcessRootTreeItem for Fission marking. r=nika
Differential Revision: https://phabricator.services.mozilla.com/D41064

--HG--
extra : moz-landing-system : lando
2019-08-07 19:24:00 +00:00
Tom Ritter
95fbdde774 Bug 1572153 - Fix recording of Telemetry Events for Eval Usage r=chutten
Differential Revision: https://phabricator.services.mozilla.com/D41045

--HG--
extra : moz-landing-system : lando
2019-08-07 16:55:22 +00:00
Birunthan Mohanathas
c561f0a0ae Bug 1376309 - Allow localhost ws:// connections from secure origins. r=jkt
We already allow HTTPS origins to use to plain HTTP active content when using
loopback URLs such as http://127.0.0.1. Lets extend this to WebSocket
connections as well to match Chrome.

Differential Revision: https://phabricator.services.mozilla.com/D38290

--HG--
extra : moz-landing-system : lando
2019-08-07 00:19:59 +00:00
Andreea Pavel
8f56db01f7 Backed out changeset d0aae34d9b95 (bug 1529068) for failing form-redirected-blocked.sub.html on a CLOSED TREE
--HG--
extra : rebase_source : 4d7a73e1f40de001031c61fba240c57961a902d8
2019-08-07 01:39:29 +03:00
Benjamin
455d7a7789 Bug 1529068 - navigate-to r=ckerschb,mccr8
Implementation of the navigate-to CSP directive as defined in CSP Level 3, https://www.w3.org/TR/CSP3/#directive-navigate-to

Differential Revision: https://phabricator.services.mozilla.com/D37139

--HG--
extra : moz-landing-system : lando
2019-08-06 18:27:45 +00:00
Tom Ritter
20c32a0175 Bug 1570738 - Record Telemetry if eval() is used in the Parent Process r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D40332

--HG--
extra : moz-landing-system : lando
2019-08-06 19:56:23 +00:00
Mihai Alexandru Michis
4bcc3ac00a Backed out changeset 8de4baa1dee3 (bug 1570658) for causing mochitest failures. CLOSED TREE 2019-08-06 14:19:31 +03:00
Sebastian Streich
6f2b641d45 Bug 1570658 - Add a Flag for Navigation-Nosniff r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D40618

--HG--
extra : moz-landing-system : lando
2019-08-05 14:58:13 +00:00
Emilio Cobos Álvarez
6da1e7506f Bug 1499000 - Make CORS use the right security flags to check whether an URL can be loaded. r=ckerschb
This fixes at least part of the problem. Without this patch, some of the flags
may get lost, like the ALLOW_CHROME flag which controls whether stuff like
resource:// URLs can be loaded or not.

Differential Revision: https://phabricator.services.mozilla.com/D40633

--HG--
extra : moz-landing-system : lando
2019-08-05 19:28:00 +00:00
Nicholas Nethercote
dd63fcde4e Bug 1570212 - Convert dom.securecontext.whitelist_onions to a static pref. r=mccr8
Differential Revision: https://phabricator.services.mozilla.com/D40160

--HG--
extra : moz-landing-system : lando
2019-08-02 11:59:06 +00:00
Tom Ritter
0b9efb84de Bug 1567623 - Add Event Telemetry for cases where eval is triggered as System Principal r=chutten,bzbarsky,tcampbell
Differential Revision: https://phabricator.services.mozilla.com/D39559

--HG--
extra : moz-landing-system : lando
2019-08-01 20:45:31 +00:00
Tom Ritter
ef67c0b08b Bug 1567623 - Update AssertEvalNotUsingSystemPrincipal and re-enable it r=ckerschb
We now correctly handle the following cases:
 - Thunderbird
 - the Browser Toolbox/Console
 - Two safe and common idioms
 - when general.config.filename is set and userChromeJS does shenanigans

We also change the function to only crash in Debug mode, and for Release channels
we report diagnostic information in a way that does not reveal user data.

Differential Revision: https://phabricator.services.mozilla.com/D39557

--HG--
extra : moz-landing-system : lando
2019-08-01 20:45:01 +00:00
Tom Ritter
88465c445c Bug 1567623 - Rename whitelist to allowlist r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D39556

--HG--
extra : moz-landing-system : lando
2019-08-01 20:44:42 +00:00
Tom Ritter
255fd27415 Bug 1567623 - Change doContentSecurityCheck logging from Debug to Verbose r=ckerschb
They are too frequent and too verbose to see any other logging statements.

Differential Revision: https://phabricator.services.mozilla.com/D39555

--HG--
extra : moz-landing-system : lando
2019-08-01 20:44:38 +00:00
Kris Maglione
d7c7e749a4 Bug 1569832: Part 0 - Update crash annotations one last time. r=mccr8
Differential Revision: https://phabricator.services.mozilla.com/D40096

--HG--
extra : moz-landing-system : lando
2019-08-01 00:53:25 +00:00
Sebastian Streich
6917b697b8 Bug 1428473 Support X-Content-Type-Options: nosniff when navigating r=ckerschb,dragana,alchen
***
Apply Requested Revision

Differential Revision: https://phabricator.services.mozilla.com/D33959

--HG--
extra : moz-landing-system : lando
2019-07-31 16:59:53 +00:00
Tom Schuster
af8f619ad2 Bug 1558915 - Use infallible nsIURI::SchemeIs in dom/security. r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D39779

--HG--
extra : moz-landing-system : lando
2019-07-30 07:23:18 +00:00
Christoph Kerschbaumer
ad40847192 Bug 1567877: Apply Meta CSP to about:devtools-toolbox. r=jdescottes,Ehsan
Differential Revision: https://phabricator.services.mozilla.com/D39328

--HG--
extra : moz-landing-system : lando
2019-07-30 07:14:09 +00:00
Thomas Nguyen
2bfaa83f89 Bug 1567573 - Apply Referrer-Policy header from redirect response r=michal
Differential Revision: https://phabricator.services.mozilla.com/D38879

--HG--
extra : moz-landing-system : lando
2019-07-29 13:51:17 +00:00
Thomas Nguyen
e0791bcabb Bug 1566833 - Add a test of loading a page in different process r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D39657

--HG--
extra : moz-landing-system : lando
2019-07-29 10:41:30 +00:00
Bogdan Tara
3736b292dc Merge inbound to mozilla-central. a=merge 2019-07-27 00:38:36 +03:00
Kannan Vijayan
3fb6190ec6 Bug 1559414 - Rename unaudited pre-fission methods with SameProcess for future audit burndown. r=nika
Differential Revision: https://phabricator.services.mozilla.com/D39378

--HG--
extra : moz-landing-system : lando
2019-07-26 16:48:31 +00:00
Kris Maglione
87884612c0 Bug 1568035: Part 4 - Update test expections for Fission. r=mccr8
Some failures crept in and out after my last sets of annotations landed. This
patch updates most of the annotations to deal with them.

MANUAL PUSH: Lando won't let me land.

Differential Revision: https://phabricator.services.mozilla.com/D39462

--HG--
extra : rebase_source : 4cfccf95c5bb2521533a9f5c4c25d67f414fb6f5
extra : histedit_source : c19187a3b3002e0eebdd809738b57641e1e432cd
2019-07-24 13:06:57 -07:00
Nicholas Nethercote
18fae65f38 Bug 1563139 - Remove StaticPrefs.h. r=glandium
This requires replacing inclusions of it with inclusions of more specific prefs
files.

The exception is that StaticPrefsAll.h, which is equivalent to StaticPrefs.h,
and is used in `Codegen.py` because doing something smarter is tricky and
suitable for a follow-up. As a result, any change to StaticPrefList.yaml will
still trigger recompilation of all the generated DOM bindings files, but that's
still a big improvement over trigger recompilation of every file that uses
static prefs.

Most of the changes in this commit are very boring. The only changes that are
not boring are modules/libpref/*, Codegen.py, and ServoBindings.toml.

Differential Revision: https://phabricator.services.mozilla.com/D39138

--HG--
extra : moz-landing-system : lando
2019-07-26 01:10:23 +00:00
Jonas Allmann
d329aefed1 Bug 1498560 - Remove new Function from autocomplete.xml, r=mak
Differential Revision: https://phabricator.services.mozilla.com/D38041

--HG--
extra : moz-landing-system : lando
2019-07-25 13:56:57 +00:00
Andreea Pavel
e4263c00eb Merge mozilla-inbound to mozilla-central. a=merge 2019-07-25 08:59:39 +03:00
Julian Descottes
dc88f9a8eb Bug 1550476 - Remove jsol.js from nsContentSecurityManager whitelist r=ckerschb
Depends on D38515

Differential Revision: https://phabricator.services.mozilla.com/D38621

--HG--
extra : moz-landing-system : lando
2019-07-19 07:26:32 +00:00
Julian Descottes
62f7f4274d Bug 1550471 - Remove jszip.js from nsContentSecurityManager whitelist r=ckerschb
Depends on D38517

Differential Revision: https://phabricator.services.mozilla.com/D38620

--HG--
extra : moz-landing-system : lando
2019-07-19 07:26:54 +00:00
Julian Descottes
fd9d673a34 Bug 1550463 - Remove lodash.js from nsContentSecurityManager whitelist r=ckerschb
Depends on D38516

Differential Revision: https://phabricator.services.mozilla.com/D38619

--HG--
extra : moz-landing-system : lando
2019-07-19 07:27:11 +00:00
Julian Descottes
f25a6fd1fb Bug 1550489 - Remove react-redux.js from nsContentSecurityManager whitelist r=ckerschb
Depends on D38513

Differential Revision: https://phabricator.services.mozilla.com/D38618

--HG--
extra : moz-landing-system : lando
2019-07-19 07:27:44 +00:00
Julian Descottes
39e4e14e35 Bug 1550485 - Remove redux.js from nsContentSecurityManager whitlelist r=ckerschb
Depends on D38514

Differential Revision: https://phabricator.services.mozilla.com/D38617

--HG--
extra : moz-landing-system : lando
2019-07-19 07:27:51 +00:00
Jonathan Kingston
9cd90ac210 Bug 1301529 - Remove X-Frame-Options allow-from. r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D38672

--HG--
extra : moz-landing-system : lando
2019-07-24 12:23:32 +00:00
Sebastian Streich
d19c155e9e Bug 1100630 - Print Related JS-Line on CSP Violation (if any) r=ckerschb,dveditz
Differential Revision: https://phabricator.services.mozilla.com/D31420

--HG--
extra : moz-landing-system : lando
2019-07-22 09:31:57 +00:00
Kris Maglione
e40b418215 Bug 1566952: Part 2 - Update Fission failure annotations after skipping crashes. r=mccr8
When a test crashes, the harness skips all of the remaining tests in the
directory. That means that with crashes skipped, we now try to run a whole lot
more tests than we did before, and a lot of them fail under Fission.

This patch adds annotations to the new failures that show up after part 1.

Differential Revision: https://phabricator.services.mozilla.com/D38726

--HG--
extra : rebase_source : 292157039c88fc615f5de41679e96e72766ac4db
2019-07-19 12:30:10 -07:00
Kris Maglione
4bd4d680d4 Bug 1566952: Part 1 - Annotate mochitests that crash with Fission enabled. r=mccr8
Differential Revision: https://phabricator.services.mozilla.com/D38725

--HG--
extra : rebase_source : 3e8b32b86b12b22d038baa770070a5c8095043c9
2019-07-17 13:37:48 -07:00
Thomas Nguyen
20e4651f5b Bug 1566417 - Update to use ReferrerInfo in prefetch and preload URI r=smaug
Differential Revision: https://phabricator.services.mozilla.com/D38323

--HG--
extra : moz-landing-system : lando
2019-07-19 11:42:09 +00:00
Tom Ritter
87cbad22ea Bug 1564527 - Enable AssertEvalNotUsingSystemPrincipal on Nightly builds r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D37460

--HG--
extra : moz-landing-system : lando
2019-07-18 18:22:06 +00:00
Christoph Kerschbaumer
1abe58c63c Bug 1550414: Add CSP test for setting parent location to javascript:. r=jkt
Differential Revision: https://phabricator.services.mozilla.com/D31233

--HG--
extra : moz-landing-system : lando
2019-07-18 16:57:54 +00:00
Noemi Erli
0497bd7b16 Backed out changeset a98b795c2b3c (bug 1100630) for Linting failure CLOSED TREE 2019-07-18 19:19:48 +03:00
Sebastian Streich
fa947e166a Bug 1100630 - Print Related JS-Line on CSP Violation (if any) r=ckerschb,dveditz
Differential Revision: https://phabricator.services.mozilla.com/D31420

--HG--
extra : moz-landing-system : lando
2019-07-18 15:14:41 +00:00
Ciure Andrei
d835b44a76 Merge inbound to mozilla-central. a=merge 2019-07-18 06:46:41 +03:00