Adding CSP to bugzilla.mozilla.org

2017-01-20 Thread Emma Humphries
We're about to enable a Content Security Policy (CSP)(1) on bugzilla.mozilla.org. CSP will mitigate several types of attack on our users and our site, including Cross-Site Request Forgery (XSRF)(2) and Cross-Site Scripting (XSS)(3). The first place we're deploying this is in the bug detail page in

Re: A reminder about MOZ_MUST_USE and [must_use]

2017-01-20 Thread ISHIKAWA,chiaki
On 2017/01/20 8:10, Nicholas Nethercote wrote: There are lots of functions where not checking the return value is reasonable, such as close(). A file opened for writing and is buffered will flush pending data to disk upon Close() and may encounter the error such as disk full AT THAT POINT, an

Re: A reminder about MOZ_MUST_USE and [must_use]

2017-01-20 Thread Michael Layzell
It wouldn't be too hard to automatically generate Result wrapper methods automatically for all of our XPIDL interfaces. I had a prototype branch at one point which did this on the rust side, as part of my now-dead rust XPIDL bindings. That would convert a good number of our fallable calls to using

Re: A reminder about MOZ_MUST_USE and [must_use]

2017-01-20 Thread Ted Mielczarek
On Fri, Jan 20, 2017, at 08:19 AM, Nicolas B. Pierron wrote: > > The Rust case is helped by the fact that `Result` is the defacto type > > for returning success or error, and it's effectively `must_use`. We > > don't have a similar default convention in C++. > > We have > > http://searchfox.org/m

Re: A reminder about MOZ_MUST_USE and [must_use]

2017-01-20 Thread Nicolas B. Pierron
On 01/20/2017 12:00 PM, Ted Mielczarek wrote: On Thu, Jan 19, 2017, at 07:00 PM, gsquel...@mozilla.com wrote: I think the point is that it's not obvious that "must check the return value" is a sufficiently-dominant common case for arbitrary return values. FWIW, Rust took the [must_use] rather th

Re: A reminder about MOZ_MUST_USE and [must_use]

2017-01-20 Thread Ted Mielczarek
On Thu, Jan 19, 2017, at 07:00 PM, gsquel...@mozilla.com wrote: > > I think the point is that it's not obvious that "must check the return > > value" is a sufficiently-dominant common case for arbitrary return values. > > FWIW, Rust took the [must_use] rather than [can_ignore] approach too. > > Th

PSA: Tail files now removed from xpcshell-tests

2017-01-20 Thread Mark Banner
We've just landed bug 503613 [1] that removes the tail file functionality from xpcshell tests. Please use do_register_cleanup function for cleanup in future (most of our code had already been transitioned to/used this function). Standard8 [1] https://bugzilla.mozilla.org/show_bug.cgi?id=5036