Usage of `new Function()` in third-party library redux.js
Categories
(Core :: DOM: Security, enhancement, P3)
Tracking
()
| Tracking | Status | |
|---|---|---|
| firefox70 | --- | fixed |
People
(Reporter: jallmann, Assigned: jdescottes)
References
(Blocks 1 open bug)
Details
(Whiteboard: [domsecurity-backlog1])
Attachments
(2 files)
All eval()-like functions (eval(), new Function(), setTimeout("")) are being removed from code running with system privileges, see Bug 1473549. An assertion is active to enforce this.
There are two occurences of new Function() in redux.js that require the file to be whitelisted for this assertion. In order to clear redux.js from the whitelist, new Function() needs to be removed or refactored. In both cases, new Function()is used to get the global object. This can poissibly be avoided by just removing the code like it was done in reudx.jsm, see Bug 1486375.
Get global object:
https://searchfox.org/mozilla-central/source/devtools/client/shared/vendor/redux.js#18
Get global object:
https://searchfox.org/mozilla-central/source/devtools/client/shared/vendor/redux.js#242
|
Reporter | |
Updated•6 years ago
|
|
Assignee | |
Updated•5 years ago
|
|
|
Assignee | |
Comment 1•5 years ago
|
||
Depends on D38513
|
|
Assignee | |
Comment 2•5 years ago
|
||
Depends on D38514
|
||
Comment 4•5 years ago
|
||
| bugherder | ||
https://hg.mozilla.org/mozilla-central/rev/dbe62a4f2b41
https://hg.mozilla.org/mozilla-central/rev/c48fcf3a6532
Description
•