Over in bug 1165272, Yoshi is converting a bunch of uses of getNoAppCodebasePrincipal to createCodebasePrincipal. Most of those are for tests, but some of them are for Desktop-only features (like about:feeds) that didn't need to be fixed up for appId, but may need to be made OriginAttribute-aware when we start using OriginAttributes on Desktop. I'm getting this bug on file to dump the ones I see when reviewing that patch.

FeedConverter.js aboutPermissions.js permissions.js PdfStreamConverter.jsm SpecialStorage.jsm Feeds.jsm Weave.js nsPermission.cpp nsPermissionManager.cpp ApplicationReputation.cpp BookmarkJSONUtils.jsm nsLiveMarkService.js SocialService.jsm NewTabUtils.jsm PermissionUtils.jsm NativeApp.jsm nsOfflineCacheUpdateService.cpp

We may also have to audit callers of getSimpleCodeBasePrincipal as well, since they essentially ignore originAttributes: http://mxr.mozilla.org/mozilla-central/source/caps/nsScriptSecurityManager.cpp#1007 http://mxr.mozilla.org/mozilla-central/source/caps/nsIScriptSecurityManager.idl#146 http://mxr.mozilla.org/mozilla-central/search?string=getsimplecodebaseprincipal

I dumped all of my notes and progress on the createCodebasePrincipal call sites in Bug 1218479.

I'm just dumping notes here so I can double check these things later. First note: Also need to audit nsDocShell::CreatePrincipalFromReferrer callers since it creates a principal from the docshell's origin attributes.

I'm changing this to be the top-level meta bug for going through all of the places we need to fix up user context consideration. So far the list of functions we care about are: createCodebasePrincipal createCodebasePrincipalFromOrigin createPrincipalFromReferrer getSimpleCodebasePrincipal There may be others. Basically, anywhere we create a principal or get one from the URI and origin attributes, needs to be looked at. I'm creating 4 meta bugs for fixing the above listed functions we care about and under those, I'm creating bugs for the individual call sites and patches.

Marking as P3 since this is a meta bug - https://wiki.mozilla.org/Bugmasters/Process/Triage#This_doesn.27t_fit_into_a_P1.2C_P2.2C_P3.2C_or_P5_framework