Re: Components and QueryInterface can no longer be used in non-system globals

[Eric Shepherd (Sheppy)]

Ironically, the timing is impressive here. I just this morning noticed that
the tables of inheritance we have in JSON for APIs includes
LegacyQueryInterface among the mixins implemented by a number of
interfaces, and was already in the process of creating a PR to remove that
since it should never have been included in the first place for open web
docs, really.

On Mon, Mar 26, 2018 at 1:55 PM, Boris Zbarsky  wrote:

> I have just landed changes on inbound that restrict WebIDL QueryInterface
> [1] and the Components object [2] to system scopes.
>
> There are two caveats:
>
> 1)  The Components bit is not fully enforced by the security
> infrastructure yet, but those patches are coming in the next day or so. [3].
>
> 2)  "system" in this case includes things that do enablePrivilege.  The
> only consumer blocking this being removed is Talos...
>
> -Boris
>
> [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1448397
> [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1448735 and
> https://bugzilla.mozilla.org/show_bug.cgi?id=1448736
> [3] https://bugzilla.mozilla.org/show_bug.cgi?id=1389585 and
> https://bugzilla.mozilla.org/show_bug.cgi?id=1389581
> ___
> dev-platform mailing list
> dev-platform@lists.mozilla.org
> https://lists.mozilla.org/listinfo/dev-platform
>



-- 

Eric Shepherd
Senior Technical Writer
Mozilla
Blog: http://www.bitstampede.com/
Twitter: http://twitter.com/sheppy
Check my Availability 
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Re: Components and QueryInterface can no longer be used in non-system globals

[Boris Zbarsky]

On 3/26/18 1:55 PM, Boris Zbarsky wrote:
I have just landed changes on inbound that restrict WebIDL 
QueryInterface [1] and the Components object [2] to system scopes.


Oh, I meant to mention: in particular there is no longer a Components 
available in XBL bindings attached to non-system-principal elements.  In 
practice, none of our in-content bindings used Components, _and_ we're 
working on getting rid of them anyway.


-Boris
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform

Components and QueryInterface can no longer be used in non-system globals

[Boris Zbarsky]

I have just landed changes on inbound that restrict WebIDL 
QueryInterface [1] and the Components object [2] to system scopes.


There are two caveats:

1)  The Components bit is not fully enforced by the security 
infrastructure yet, but those patches are coming in the next day or so. [3].


2)  "system" in this case includes things that do enablePrivilege.  The 
only consumer blocking this being removed is Talos...


-Boris

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1448397
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1448735 and
https://bugzilla.mozilla.org/show_bug.cgi?id=1448736
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=1389585 and
https://bugzilla.mozilla.org/show_bug.cgi?id=1389581
___
dev-platform mailing list
dev-platform@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-platform