We're about to enable a Content Security Policy (CSP)(1) on bugzilla.mozilla.org. CSP will mitigate several types of attack on our users and our site, including Cross-Site Request Forgery (XSRF)(2) and Cross-Site Scripting (XSS)(3).
The first place we're deploying this is in the bug detail page in the new Modal view (which, you may recall, we're making the default view (4)) with a goal for the site to have complete CSP coverage. As a side-effect of this work, CSP may break add-ons that modify the bug detail page. If we have broken something of yours, we can quickly fix it. We're already enabling the Socorro Lens add-on(5). You can see how that was addressed(6) āā . Web Extensions can modify the DOM of a bug detail page through `content.js`. You cannot load images, javascript, iframes, form actions, or css from external sites ā, uā nless we make an exception for you(7). Long term, if you have a feature from an add-on you'd like to make part of BMO, please seek me out on irc://irc.mozilla.org/bteam or open a new ticket in the bugzilla.mozilla.org product in Bugzilla and set the severity to 'enhancement'(8). Thank you, Emma (šš©) 1: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP 2: https://www.owasp.org/index.php/CSRF 3: https://www.owasp.org/index.php/XSS 4: https://groups.google.com/forum/#!topic/mozilla.dev.platform/_AFaUi3JQhs 5: https://addons.mozilla.org/en-US/firefox/addon/bugzilla-socorro-lens/ 6: https://github.com/ashughes1/bugzilla-socorro-lens/issues/19 7: https://wiki.mozilla.org/BMO/Add-on_Registry 8: https://bugzilla.mozilla.org/enter_bug.cgi?product=bugzilla.mozilla.org&bug_severity=enhancement _______________________________________________ dev-platform mailing list dev-platform@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-platform
