Backed out 2 changesets (bug 371900) for causing bug 1749182 . CLOSED TREE

Backed out changeset e59035c65af3 (bug 371900)
Backed out changeset 6434bce9c7d4 (bug 371900)

browser/base/content/browser-development-helpers.js

@@ -30,6 +30,7 @@ var DevelopmentHelpers = {
     let command = document.createXULElement("command");
     command.setAttribute("id", "cmd_quickRestart");
     command.addEventListener("command", this.quickRestart, true);
+    command.setAttribute("oncommand", "void 0;"); // Needed - bug 371900
     document.getElementById("mainCommandSet").prepend(command);
 
     let key = document.createXULElement("key");
@@ -37,6 +38,7 @@ var DevelopmentHelpers = {
     key.setAttribute("key", "r");
     key.setAttribute("modifiers", "accel,alt");
     key.setAttribute("command", "cmd_quickRestart");
+    key.setAttribute("oncommand", "void 0;"); // Needed - bug 371900
     document.getElementById("mainKeyset").prepend(key);
 
     let menuitem = document.createXULElement("menuitem");

browser/base/content/browser-sets.inc

@@ -170,8 +170,7 @@
     <key id="key_toggleMute" data-l10n-id="mute-toggle-shortcut" command="cmd_toggleMute" modifiers="control"/>
     <key id="key_undo"
          data-l10n-id="text-action-undo-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <key id="key_redo"
 #ifdef XP_UNIX
          data-l10n-id="text-action-undo-shortcut"
@@ -180,21 +179,18 @@
          data-l10n-id="text-action-redo-shortcut"
          modifiers="accel"
 #endif
-         internal="true"/>
+         />
     <key id="key_cut"
          data-l10n-id="text-action-cut-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <key id="key_copy"
          data-l10n-id="text-action-copy-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <key id="key_paste"
          data-l10n-id="text-action-paste-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <key id="key_delete" keycode="VK_DELETE" command="cmd_delete" reserved="false"/>
-    <key id="key_selectAll" data-l10n-id="text-action-select-all-shortcut" modifiers="accel" internal="true"/>
+    <key id="key_selectAll" data-l10n-id="text-action-select-all-shortcut" modifiers="accel"/>
 
     <key keycode="VK_BACK" command="cmd_handleBackspace" reserved="false"/>
     <key keycode="VK_BACK" command="cmd_handleShiftBackspace" modifiers="shift" reserved="false"/>
@@ -314,9 +310,7 @@
 # On OS X, dark voodoo magic invokes the quit code for this key.
 # So we're not adding the attribute on OSX because of backwards/add-on compat.
 # See bug 1369909 for background on this.
-#ifdef XP_MACOSX
-         internal="true"
-#else
+#ifndef XP_MACOSX
          command="cmd_quitApplication"
 #endif
          reserved="true"/>
@@ -367,25 +361,20 @@
     <key id="key_minimizeWindow"
          command="minimizeWindow"
          data-l10n-id="window-minimize-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <key id="key_openHelpMac"
          oncommand="openHelpLink('firefox-osxkey');"
          data-l10n-id="help-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <!-- These are used to build the Application menu -->
     <key id="key_preferencesCmdMac"
          data-l10n-id="preferences-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <key id="key_hideThisAppCmdMac"
          data-l10n-id="hide-app-shortcut"
-         modifiers="accel"
-         internal="true"/>
+         modifiers="accel"/>
     <key id="key_hideOtherAppsCmdMac"
          data-l10n-id="hide-other-apps-shortcut"
-         modifiers="accel,alt"
-         internal="true"/>
+         modifiers="accel,alt"/>
 #endif
   </keyset>

browser/components/downloads/content/contentAreaDownloadsView.xhtml

@@ -15,11 +15,15 @@
 %editMenuDTD;
 ]>
 
+<!-- @CSP: We have to whitelist the 'oncommand' handler for all the cmd_* fields within
+   - editMenuOverlay.js until Bug 371900 is fixed using
+   -    sha512-4o5Uf4E4EG+90Mb820FH2YFDf4IuX4bfUwQC7reK1ZhgcXWJBKMK2330XIELaFJJ8HiPffS9mP60MPjuXMIrHA==
+   -->
 <window id="contentAreaDownloadsView"
         data-l10n-id="downloads-window"
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         xmlns:html="http://www.w3.org/1999/xhtml"
-        csp="default-src chrome:; img-src chrome: moz-icon:; object-src 'none'">
+        csp="default-src chrome:; script-src chrome: 'sha512-4o5Uf4E4EG+90Mb820FH2YFDf4IuX4bfUwQC7reK1ZhgcXWJBKMK2330XIELaFJJ8HiPffS9mP60MPjuXMIrHA=='; img-src chrome: moz-icon:; object-src 'none'">
 
   <linkset>
     <html:link rel="localization" href="toolkit/global/textActions.ftl"/>

browser/components/preferences/preferences.js

@@ -238,10 +238,6 @@ function init_all() {
 
   window.addEventListener("hashchange", onHashChange);
 
-  document.getElementById("focusSearch1").addEventListener("command", () => {
-    gSearchResultsPane.searchInput.focus();
-  });
-
   gotoPref().then(() => {
     let helpButton = document.getElementById("helpButton");
     let helpUrl =

browser/components/preferences/preferences.xhtml

@@ -22,8 +22,11 @@
         id="preferences-root">
 
 <head>
-  <!-- @CSP: We should remove 'unsafe-inline' from style-src, see Bug 1579160 -->
-  <meta http-equiv="Content-Security-Policy" content="default-src chrome:; img-src chrome: moz-icon: https: data:; style-src chrome: data: 'unsafe-inline'; object-src 'none'" />
+  <!-- @CSP: The 'oncommand' handler for 'focusSearch1' can not easily be rewritten (see Bug 371900)
+       hence we are allowing the inline handler in the script-src directive using the hash
+       sha512-X8+p/CqXeMdssOoFOf5RV+RpkvnN9pukQ20acGc7LqMgfYLW+lR0WAYT66OtSTpFHE/Qgx/ZCBs2RMc4QrA8FQ==
+       Additionally we should remove 'unsafe-inline' from style-src, see Bug 1579160 -->
+  <meta http-equiv="Content-Security-Policy" content="default-src chrome:; script-src chrome: 'sha512-X8+p/CqXeMdssOoFOf5RV+RpkvnN9pukQ20acGc7LqMgfYLW+lR0WAYT66OtSTpFHE/Qgx/ZCBs2RMc4QrA8FQ=='; img-src chrome: moz-icon: https: data:; style-src chrome: data: 'unsafe-inline'; object-src 'none'" />
 
   <title data-l10n-id="settings-page-title"></title>
 
@@ -179,7 +182,9 @@
     </vbox>
 
     <keyset>
-      <key data-l10n-id="focus-search" key="" modifiers="accel" id="focusSearch1"/>
+      <!-- If you change the code within the oncommand handler of 'focusSearch1' you have to update the current hash of
+           sha512-X8+p/CqXeMdssOoFOf5RV+RpkvnN9pukQ20acGc7LqMgfYLW+lR0WAYT66OtSTpFHE/Qgx/ZCBs2RMc4QrA8FQ== within the CSP above. -->
+      <key data-l10n-id="focus-search" key="" modifiers="accel" id="focusSearch1" oncommand="gSearchResultsPane.searchInput.focus();"/>
     </keyset>
 
     <vbox class="main-content" flex="1" align="start">

devtools/startup/DevToolsStartup.jsm

@@ -908,6 +908,8 @@ DevToolsStartup.prototype = {
       k.setAttribute("modifiers", mod);
     }
 
+    // Bug 371900: command event is fired only if "oncommand" attribute is set.
+    k.setAttribute("oncommand", ";");
     k.addEventListener("command", oncommand);
 
     return k;

dom/events/GlobalKeyListener.cpp

@@ -584,13 +584,8 @@ bool XULKeySetGlobalKeyListener::IsExecutableElement(
     return false;
   }
 
-  // Internal keys are defined as <key> elements so that the menu label
-  // and disabled state can be updated properly, but the command is executed
-  // by some other means. This will typically be because the key is defined
-  // as a shortcut defined in ShortcutKeyDefinitions.cpp instead, or on Mac,
-  // some special system defined keys.
-  return !aElement->AttrValueIs(kNameSpaceID_None, nsGkAtoms::internal,
-                                nsGkAtoms::_true, eCaseMatters);
+  aElement->GetAttr(nsGkAtoms::oncommand, value);
+  return !value.IsEmpty();
 }
 
 already_AddRefed<dom::EventTarget> XULKeySetGlobalKeyListener::GetHandlerTarget(

toolkit/content/editMenuOverlay.js

@@ -40,6 +40,9 @@ function goUpdatePasteMenuItems() {
 window.addEventListener(
   "DOMContentLoaded",
   () => {
+    // Bug 371900: Remove useless oncommand attribute once bug 371900 is fixed
+    // If you remove/update the oncommand attribute for any of the cmd_*, please
+    // also remove/update the sha512 hash in the CSP within about:downloads
     let container =
       document.querySelector("commandset") || document.documentElement;
     let fragment = MozXULElement.parseXULToFragment(`
@@ -47,14 +50,14 @@ window.addEventListener(
         <commandset id="editMenuCommandSetAll" commandupdater="true" events="focus,select" />
         <commandset id="editMenuCommandSetUndo" commandupdater="true" events="undo" />
         <commandset id="editMenuCommandSetPaste" commandupdater="true" events="clipboard" />
-        <command id="cmd_undo" internal="true"/>
-        <command id="cmd_redo" internal="true" />
-        <command id="cmd_cut" internal="true" />
-        <command id="cmd_copy" internal="true" />
-        <command id="cmd_paste" internal="true" />
-        <command id="cmd_delete" internal="true" />
-        <command id="cmd_selectAll" internal="true" />
-        <command id="cmd_switchTextDirection" />
+        <command id="cmd_undo" oncommand=";" />
+        <command id="cmd_redo" oncommand=";" />
+        <command id="cmd_cut" oncommand=";" />
+        <command id="cmd_copy" oncommand=";" />
+        <command id="cmd_paste" oncommand=";" />
+        <command id="cmd_delete" oncommand=";" />
+        <command id="cmd_selectAll" oncommand=";" />
+        <command id="cmd_switchTextDirection" oncommand=";" />
       </commandset>
     `);
 

toolkit/content/tests/chrome/window_keys.xhtml

@@ -55,21 +55,12 @@ var keysToTest = [
   ["k-g-co", "G", { ctrlKey: true, osKey: true } ],
   ["scommand", "Y", { } ],
   ["", "U", { } ],
-  ["k-z-c", "Z", { ctrlKey: true } ],
 ];
 
 function runTest()
 {
-  let nonInlineKeyFired = false;
-  document.getElementById("k-z-c").addEventListener("command", event => {
-    nonInlineKeyFired = true;
-    checkKey(event);
-  });
-
   iterateKeys(true, "normal");
 
-  ok(nonInlineKeyFired, "non-inline command listener fired");
-
   var keyset = document.getElementById("keyset");
   keyset.setAttribute("disabled", "true");
   iterateKeys(false, "disabled");
@@ -183,7 +174,6 @@ SimpleTest.waitForFocus(runTest);
   <key id="k-g-co" key="g" modifiers="control os" oncommand="checkKey(event)"/>
   <key id="k-y" key="y" command="scommand"/>
   <key id="k-u" key="u" command="scommand-disabled"/>
-  <key id="k-z-c" key="z" modifiers="control"/>
 </keyset>
 
 <keyset id="keyset2">

tools/lint/eslint/eslint-plugin-mozilla/lib/processors/xul.js

@@ -140,6 +140,10 @@ function addSyntheticLine(line, linePos, addDisableLine) {
 function recursiveExpand(node) {
   for (let [attr, value] of Object.entries(node.attributes)) {
     if (attr.startsWith("on")) {
+      if (attr == "oncommand" && value == ";") {
+        // Ignore these, see bug 371900 for why people might do this.
+        continue;
+      }
       // Ignore dashes in the tag name
       let nodeDesc = node.local.replace(/-/g, "");
       if (node.attributes.id) {

xpcom/ds/StaticAtoms.py

@@ -554,7 +554,6 @@ STATIC_ATOMS = [
     Atom("insertion", "insertion"),
     Atom("integer", "integer"),
     Atom("integrity", "integrity"),
-    Atom("internal", "internal"),
     Atom("internals", "internals"),
     Atom("intersection", "intersection"),
     Atom("intersectionobserverlist", "intersectionobserverlist"),