5784769019
Bug 1443079 - nsScriptError.isFromPrivateWindow must match the correct value also in e10s mode, r=smaug
2018-03-13 06:40:38 +01:00
aebd2b4f26
Bug 1391823 - Disable dom/security/test/mixedcontentblocker/test_frameNavigation.html for frequent failures. r=jmaher
2018-03-03 05:16:00 +02:00
118e03a936
merge mozilla-central to mozilla-inbound
2018-03-01 20:32:20 +02:00
61d400da1c
Merge inbound to mozilla-central. a=merge
2018-03-01 19:29:00 +02:00
f58841a715
Tests updated/added for bug 1382359 r=ckerschb CLOSED TREE
2018-03-01 10:13:22 +01:00
dd4fb3ba9f
Bug 1382359: Treat .onion as a secure context
...
Websites which collect passwords but don't use HTTPS start showing scary
warnings from Firefox 51 onwards and mixed context blocking has been
available even longer.
.onion sites without HTTPS support are affected as well, although their
traffic is encrypted and authenticated. This patch addresses this
shortcoming by making sure .onion sites are treated as potentially
trustworthy origins.
The secure context specification
(https://w3c.github.io/webappsec-secure-contexts/ ) is pretty much focused
on tying security and trustworthiness to the protocol over which domains
are accessed. However, it is not obvious why .onion sites should not be
treated as potentially trustworthy given:
"A potentially trustworthy origin is one which a user agent can
generally trust as delivering data securely.
This algorithms [sic] considers certain hosts, scheme, and origins as
potentially trustworthy, even though they might not be authenticated and
encrypted in the traditional sense."
(https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy )
We use step 8 in the algorithm to establish trustworthiness of .onion
sites by whitelisting them given the encrypted and authenticated nature
of their traffic.
2018-03-01 09:44:30 +01:00
fc42b2fa73
Bug 1355166 - Remove remote newtab's dead code. r=ursula
2018-02-28 16:44:00 +02:00
8ea55ce28a
Bug 1382606 - Switch webconsole to new event-emitter; r=Honza.
...
MozReview-Commit-ID: HBogPeOI7WM
--HG--
extra : rebase_source : 4ad1fb922ffc818d175ae3c09820ce31ba416487
2018-02-23 09:10:36 +01:00
c714053d73
Bug 1433175 - scripted patch to replace Components.classes[, Components.interfaces.nsI, Components.utils. and Components.results. with Cc, Ci, Cu and Cr, r=Mossop.
2018-02-28 18:51:33 +01:00
84b854ce2c
Bug 1433958 - Change code that sets nsIURI.userPass to use nsIURIMutator r=mayhemer
...
* Code in XMLHttpRequestMainThread is converted to set the username and password individually. This is because when the parameters are empty, it ended up calling SetUserPass(":") which always returns an error.
MozReview-Commit-ID: 3cK5HeyzjFE
--HG--
extra : rebase_source : f34400c11245d88648b0ae9c196637628afa9517
2018-02-26 20:43:46 +01:00
e8f5150467
Bug 1439444: resource and chrome images and styles should not be subject to CSP. r=gijs
2018-03-01 13:45:04 +01:00
eab7568bd9
Bug 1441794 - Add deprecation warning to passive OBJECT_SUBREQUEST loads. r=ckerschb
...
MozReview-Commit-ID: 3j2t5FDZFmp
--HG--
extra : rebase_source : f18623e42ba4fd54335d26536e4d40deab15c584
2018-02-28 13:56:35 +00:00
2a77281049
Merge mozilla-central to autoland. a=merge CLOSED TREE
2018-02-21 19:30:44 +02:00
a6c1ffb498
Bug 1434357: Exempt Web Extensions from insecure redirects to data: URIs. r=kmag,mayhemer
2018-02-18 19:52:52 +01:00
8afc412494
Bug 1435733 - Upgrade mixed display content pref. r=baku,ckerschb,francois,mayhemer
...
MozReview-Commit-ID: ETIgVF3zhRu
--HG--
extra : rebase_source : e4c59f50584158f4b31527347b10424b56692fa1
2018-02-05 15:37:27 +00:00
1407489a4b
Bug 1432358: Make resource URIs subject to CSP. r=gijs
...
--HG--
extra : source : 60852dec9e041887bea80313a70ad2a4cba745a6
extra : intermediate-source : 91c948c94506089d6f40dc59d13c75ab78ce914d
2018-01-25 14:20:31 +01:00
a6cab8c4e8
Backed out 4 changesets (bug 1432358) for failing xpcshell's test_ext_contentscript_triggeringPrincipal.js
...
Backed out changeset ef7b8eef07c1 (bug 1432358)
Backed out changeset 2fa11c525da3 (bug 1432358)
Backed out changeset a67e95bd0ccf (bug 1432358)
Backed out changeset 91c948c94506 (bug 1432358)
2018-02-12 19:58:28 +02:00
6575d66c41
Bug 1432358: Make resource URIs subject to CSP. r=gijs
...
--HG--
extra : source : 60852dec9e041887bea80313a70ad2a4cba745a6
2018-01-25 14:20:31 +01:00
b7bb86d0d4
Bug 1436184 - Remove definitions of Ci, Cr, Cc, and Cu from httpd.js and .sjs files. r=florian
...
MozReview-Commit-ID: IKKb9zr2OSf
--HG--
extra : rebase_source : 72d949405c18e6d421422e7865182352eee0c407
2018-02-06 15:03:13 -08:00
5dec0e0beb
Bug 1432992, part 1 - Remove definitions of Ci, Cr, Cc, and Cu. r=florian
...
This patch was autogenerated by my decomponents.py
It covers almost every file with the extension js, jsm, html, py,
xhtml, or xul.
It removes blank lines after removed lines, when the removed lines are
preceded by either blank lines or the start of a new block. The "start
of a new block" is defined fairly hackily: either the line starts with
//, ends with */, ends with {, <
Andrea Marchesini
Cristian Brindusan
Sebastian Hengst
Tiberius Oros
Georg Koppen
Adam Kasztenny
Nicolas Chevobbe
Florian Quèze
Valentin Gosu
Christoph Kerschbaumer
Jonathan Kingston
Gurzau Raul
Andrew McCreight
Kris Maglione
Boris Zbarsky
Cosmin Sabou
Brindusan Cristian
vinoth
Chung-Sheng Fu
Andreea Pavel
Chris Peterson
Honza Bambas
Gijs Kruitbosch
Kate McKinley
Ryan VanderMeulen