Kris Maglione b3cac601f6 Bug 1432966: Sanitize HTML fragments created for chrome-privileged documents. r=bz f=gijs ... This is a short-term solution to our inability to apply CSP to chrome-privileged documents. Ideally, we should be preventing all inline script execution in chrome-privileged documents, since the reprecussions of XSS in chrome documents are much worse than in content documents. Unfortunately, that's not possible in the near term because a) we don't support CSP in system principal documents at all, and b) we rely heavily on inline JS in our static XUL. This stop-gap solution at least prevents some of the most common vectors of XSS attack, by automatically sanitizing any HTML fragment created for a chrome-privileged document. MozReview-Commit-ID: 5w17celRFr --HG-- extra : rebase_source : 1c0a1448a06d5b65e548d9f5362d06cc6d865dbe extra : amend_source : 7184593019f238b86fd1e261941d8e8286fa4006		2018-01-24 14:56:48 -08:00
..
acorn	Bug 1421992 - script-generated patch to replace do_execute_soon, do_print and do_register_cleanup with executeSoon, info and registerCleanupFunction, rs=Gijs.	2017-12-21 11:10:23 +01:00
apps	Bug 1398061 - Remove simulators from WebIDE. r=jdescottes	2017-09-25 11:37:18 +02:00
client	Bug 1430799 - Add a createObjectClient method to the DebuggerClient;r=jlast.	2018-01-16 17:25:58 +01:00
css	Bug 1255402 - fix getCSSValuesForProperty for object-position and perspective-origin; r=heycam	2018-01-16 10:52:28 -07:00
discovery	Bug 1428043 - Remove useless systemlibs.js import; r=jryans	2018-01-04 16:20:59 +01:00
fronts	Bug 1408124 - Create a new perf actor and recording panel; r=julienw	2017-11-08 10:36:43 -06:00
gcli	Bug 1432966: Sanitize HTML fragments created for chrome-privileged documents. r=bz f=gijs	2018-01-24 14:56:48 -08:00
heapsnapshot	Bug 1428535 - Add missing override specifiers to overridden virtual functions. r=froydnj	2017-11-05 19:37:28 -08:00
inspector	Bug 1427512 - Part 16: Remove nsIDOMCSSRule. r=xidorn,jryans,bz	2018-01-11 16:17:56 +08:00
jsbeautify	Backed out changeset 192d517219c1 (bug 1369801)	2017-07-27 18:14:38 +02:00
layout	Bug 1303171 - Adjust highlighters to account for writing mode and text dir. r=gl	2017-12-08 22:18:21 -06:00
locales	Bug 1425280 - Fix localization note mismatch in devtools files;r=pbro	2017-12-14 15:43:37 -06:00
node-properties
performance	Bug 1392098 - Enable the new ESLint no-useless-run-test rule across the tree. r=mossop	2017-08-20 18:52:05 +01:00
platform	Bug 1403489 - remove special loader rule for devtools/shared/platform;r=tromey	2017-09-27 12:38:23 +02:00
pretty-fast	Backed out changeset 192d517219c1 (bug 1369801)	2017-07-27 18:14:38 +02:00
qrcode	Bug 1421992 - script-generated patch to replace do_check_* functions with their Assert.* equivalents, rs=Gijs.	2017-12-21 11:08:17 +01:00
security	Bug 1272774 - migrate all listTabs() callers to use promise;r=ochameau	2018-01-15 18:38:34 +01:00
sourcemap	Bug 1403610 - update to source-map 0.6.1; r=bgrins	2017-09-27 09:39:44 -06:00
specs	Bug 1408124 - Create a new perf actor and recording panel; r=julienw	2017-11-08 10:36:43 -06:00
sprintfjs	Bug 1406311 - sprintfjs: optimise string-format for %S patterns;r=bgrins	2017-10-17 21:11:48 +02:00
test-helpers	Bug 1423517 - Helps tracking JS allocations when running DevTools tests. r=jdescottes	2017-12-06 01:36:51 -08:00
tests	Bug 1432966: Sanitize HTML fragments created for chrome-privileged documents. r=bz f=gijs	2018-01-24 14:56:48 -08:00
transport	Bug 1272774 - migrate all listTabs() callers to use promise;r=ochameau	2018-01-15 18:38:34 +01:00
webconsole	Bug 1431758 - do not use netmonitor data to fetch stylesheets over 1MB;r=jryans	2018-01-20 00:24:41 +01:00
worker	Bug 1403489 - remove special loader rule for devtools/shared/platform;r=tromey	2017-09-27 12:38:23 +02:00
.eslintrc.js
async-storage.js	Bug 1387122 - Remove all useless Promise = require("promise"). r=tromey	2017-08-07 17:53:29 +02:00
async-utils.js	Bug 1387122 - Remove all useless Promise = require("promise"). r=tromey	2017-08-07 17:53:29 +02:00
base-loader.js	Bug 1399493 - Upgrade to React 15.6.1 and include dev & prod version r=jdescottes,jlast	2017-09-14 13:32:06 +01:00
builtin-modules.js	Bug 1427512 - Part 16: Remove nsIDOMCSSRule. r=xidorn,jryans,bz	2018-01-11 16:17:56 +08:00
content-observer.js	Bug 1391562 - use obj.on/off/emit rather than static methods from devtools event-emitter;r=zer0	2017-08-18 17:05:04 +02:00
debounce.js	Bug 1383037 - Use only one debounce function in devtools. r=pbro	2017-10-03 11:03:19 +01:00
defer.js
deprecated-sync-thenables.js
DevToolsUtils.js	Bug 1231211 P19 Make DevToolsUtils.newChannelForURL() set the loadingNode so that the SW controller is set on the channel. r=jryans	2018-01-23 10:38:54 -05:00
dom-node-constants.js
dom-node-filter-constants.js
event-emitter.js	Bug 1137935 - add support for wildcard event type in devtools event emitter;r=ochameau	2017-08-17 16:42:50 +02:00
extend.js	Backed out changeset 68c5012ba344 (bug 1378850) for ESlint no-unused-vars failures on a CLOSED TREE.	2017-07-19 12:26:25 -04:00
flags.js
generate-uuid.js	Bug 1378824 - Stop using sdk/util/uuid in DevTools. r=jdescottes	2017-07-28 14:36:33 +01:00
indentation.js
indexed-db.js	Bug 1361333 - move sdk/util/indexed-db to devtools;r=ochameau	2017-07-31 21:55:33 +02:00
jar.mn	Bug 863246 - Move resources that need to be exposed to web content to locations that are marked as contentaccessible r=billm	2017-06-08 17:52:46 +08:00
l10n.js	Bug 1406375 - always localize numbers in l10n::numbersWithDecimals;r=Honza	2017-10-06 15:14:56 +02:00
loader-plugin-raw.jsm	Bug 1395834 - Implement theme loader; r=nchevobbe	2017-09-14 10:03:26 +02:00
Loader.jsm	Bug 1403489 - remove special loader rule for devtools/shared/platform;r=tromey	2017-09-27 12:38:23 +02:00
moz.build	Bug 1423517 - Helps tracking JS allocations when running DevTools tests. r=jdescottes	2017-12-06 01:36:51 -08:00
old-event-emitter.js	Bug 1381542 - renamed "devtools/shared/event-emitter" in "devtools/shared/old-event-emitter"; r=ochameau	2017-08-11 03:47:30 +02:00
Parser.jsm	Bug 1228841 - Part 3: Remove conditional catch handling in devtools. r=jdescottes	2017-12-06 23:44:17 +09:00
path.js
plural-form.js
protocol.js	Bug 1432496 - Clean up protocol.js deprecations. r=jdescottes	2018-01-23 09:15:49 -06:00
system.js	Bug 1421066 - remove getAppIniString from devtools/shared/system.js; r=ochameau	2017-11-28 09:04:10 -07:00
task.js	Bug 1387122 - Remove all useless Promise = require("promise"). r=tromey	2017-08-07 17:53:29 +02:00
ThreadSafeDevToolsUtils.js	Bug 1382833 - Don't throw when dealing with CPOWs in the Object Actor;r=jimb	2017-07-26 11:22:56 -07:00
throttle.js	Bug 1171482 - extract throttle to dedicated util;r=bgrins	2017-10-18 13:05:32 +02:00
wasm-source-map.js