Re: Windows Address Sanitizer enabled on trunk

2018-06-01 Thread Nicholas Nethercote
This is excellent news! Great work by all those involved. Nick On Sat, Jun 2, 2018 at 5:16 AM, David Major wrote: > Bug 1360120 on inbound enables Windows ASan builds and tests on trunk > branches. > > Initially these are tier-2 while we confirm that this doesn't > introduce test flakiness. If

No more unsafe innerHTML in system privileged Firefox code, for good

2018-06-01 Thread Johann Hofmann
tl;dr Raw markup injection (e.g. through innerHTML) in system-privileged content is automatically sanitized and we have removed all exceptions to this rule. You should still not use innerHTML and friends. Hello everyone, The danger of remote code execution (RCE) exploits through unescaped inner

Windows Address Sanitizer enabled on trunk

2018-06-01 Thread David Major
Bug 1360120 on inbound enables Windows ASan builds and tests on trunk branches. Initially these are tier-2 while we confirm that this doesn't introduce test flakiness. If nothing catches fire, I intend to bump them to tier-1 in the near future. You can run these jobs on try under the platform nam

Re: nsIClearDataService

2018-06-01 Thread Anne van Kesteren
Thanks for working on this! Clear-Site-Data seems pretty essential to have now we ship service workers. On Fri, Jun 1, 2018 at 6:26 PM, Andrea Marchesini wrote: > Note for the DOM/QuotaManager/ServiceWorker people: this component covers > all the DOM storages under 1 single flag: CLEAR_DOM_QUOTA.

nsIClearDataService

2018-06-01 Thread Andrea Marchesini
Hi all, As probably many of you remember, in the past we had several issues with deleting site data. The main reason was that we have too many ways to delete data and they were/are out of sync: ForgetAboutSite, Sanitizer.jsm for android, Sanitizer.jsm for desktop, etc (some data is deleted by some