Open Bug 1322618 Opened 8 years ago Updated 2 years ago

Provide a CSP or sandbox flags to disable script, instead of using content policy hacks

Categories

(Thunderbird :: Message Reader UI, defect)

Product:
Thunderbird
Component:
Message Reader UI
Type:
defect

Tracking

(Not tracked)

People

(Reporter: bzbarsky, Unassigned)

References

(Depends on 1 open bug)

Details

Right now nsMsgContentPolicy::ShouldLoad does some script-disabling that is pretty fragile. What we should do instead is have the relevant channels produce a CSP (possibly one that sets a sandbox, if we want it to apply to subframes?) using the API added in bug 1322617. And then we should be able to remove the nsMsgContentPolicy::ShouldLoad hackery.
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.