Re: Intent to unship: @-moz-document from content pages.

2018-03-19 Thread Emilio Cobos Álvarez
On 3/19/18 11:21 AM, Emilio Cobos Álvarez wrote: > On 11/29/17 6:36 PM, Mike Taylor wrote: >> >>> On Nov 29, 2017, at 10:53 AM, Emilio Cobos Álvarez wrote: >>> >>> In bug 1035091 I intend to remove support for the @-moz-document CSS >>> rule in content pages (more exactly in

Re: Intent to unship: @-moz-document from content pages.

2018-03-19 Thread Emilio Cobos Álvarez
On 11/29/17 6:36 PM, Mike Taylor wrote: > >> On Nov 29, 2017, at 10:53 AM, Emilio Cobos Álvarez wrote: >> >> In bug 1035091 I intend to remove support for the @-moz-document CSS >> rule in content pages (more exactly in author stylesheets). > > This is a pretty widely used

Re: Intent to unship: @-moz-document from content pages.

2017-11-29 Thread Karl Dubost
Le 30 nov. 2017 à 02:42, Emilio Cobos Álvarez a écrit : > On 11/29/2017 06:36 PM, Mike Taylor wrote: >> This is a pretty widely used mechanism to target styles for Gecko. Would it >> be possible to disable in non-release for a few releases to sniff out any >> major

Re: Intent to unship: @-moz-document from content pages.

2017-11-29 Thread Boris Zbarsky
On 11/29/17 12:42 PM, Emilio Cobos Álvarez wrote: Another thing we could try to do if plain unshipping fails would be to just hide the regex matching function, which IIUC would prevent the security issue too. But hiding it behind a pref on non-release for now sounds good. Boris, would you also

Re: Intent to unship: @-moz-document from content pages.

2017-11-29 Thread Emilio Cobos Álvarez
On 11/29/2017 06:36 PM, Mike Taylor wrote: > >> On Nov 29, 2017, at 10:53 AM, Emilio Cobos Álvarez wrote: >> >> In bug 1035091 I intend to remove support for the @-moz-document CSS >> rule in content pages (more exactly in author stylesheets). > > This is a pretty widely used

Re: Intent to unship: @-moz-document from content pages.

2017-11-29 Thread Mike Taylor
> On Nov 29, 2017, at 10:53 AM, Emilio Cobos Álvarez wrote: > > In bug 1035091 I intend to remove support for the @-moz-document CSS > rule in content pages (more exactly in author stylesheets). This is a pretty widely used mechanism to target styles for Gecko. Would it be

Re: Intent to unship: @-moz-document from content pages.

2017-11-29 Thread Boris Zbarsky
On 11/29/17 11:53 AM, Emilio Cobos Álvarez wrote: Let me know if there's any concern on doing this. @-moz-document url-prefix() { /* rules go here */ } at least used to be a somewhat common way to have "Firefox-only" rules on web pages.

Re: Intent to unship: @-moz-document from content pages.

2017-11-29 Thread Xidorn Quan
On Thu, Nov 30, 2017, at 03:53 AM, Emilio Cobos Álvarez wrote: > Hi again, > > In bug 1035091 I intend to remove support for the @-moz-document CSS > rule in content pages (more exactly in author stylesheets). > > The reasoning for this, apart from it being a non-standard mozilla-only > CSS

Intent to unship: @-moz-document from content pages.

2017-11-29 Thread Emilio Cobos Álvarez
Hi again, In bug 1035091 I intend to remove support for the @-moz-document CSS rule in content pages (more exactly in author stylesheets). The reasoning for this, apart from it being a non-standard mozilla-only CSS feature, is that it's a possible security risk in presence of CSS injection