Backed out changeset 6fefdfdfe325 (bug 1665056) for causing mass failures CLOSED TREE

caps/ContentPrincipal.cpp

@@ -103,7 +103,7 @@ nsresult ContentPrincipal::GenerateOriginNoSuffixFromURI(
              "The inner URI for about:blank must be moz-safe-about:blank");
 
   // Handle non-strict file:// uris.
-  if (!StaticPrefs::security_fileuri_strict_origin_policy_AtStartup() &&
+  if (!nsScriptSecurityManager::GetStrictFileOriginPolicy() &&
       NS_URIIsLocalFile(origin)) {
     // If strict file origin policy is not in effect, all local files are
     // considered to be same-origin, so return a known dummy origin here.
@@ -367,7 +367,7 @@ static nsresult GetSpecialBaseDomain(const nsCOMPtr<nsIURI>& aURI,
   if (NS_URIIsLocalFile(aURI)) {
     // If strict file origin policy is not in effect, all local files are
     // considered to be same-origin, so return a known dummy domain here.
-    if (!StaticPrefs::security_fileuri_strict_origin_policy_AtStartup()) {
+    if (!nsScriptSecurityManager::GetStrictFileOriginPolicy()) {
       *aHandled = true;
       aBaseDomain.AssignLiteral("UNIVERSAL_FILE_URI_ORIGIN");
       return NS_OK;

caps/nsScriptSecurityManager.cpp

@@ -84,6 +84,7 @@ using namespace mozilla;
 using namespace mozilla::dom;
 
 StaticRefPtr<nsIIOService> nsScriptSecurityManager::sIOService;
+std::atomic<bool> nsScriptSecurityManager::sStrictFileOriginPolicy = true;
 
 namespace {
 
@@ -217,9 +218,8 @@ inline void SetPendingException(JSContext* cx, const char16_t* aMsg) {
 /* static */
 bool nsScriptSecurityManager::SecurityCompareURIs(nsIURI* aSourceURI,
                                                   nsIURI* aTargetURI) {
-  return NS_SecurityCompareURIs(
+  return NS_SecurityCompareURIs(aSourceURI, aTargetURI,
-      aSourceURI, aTargetURI,
+                                sStrictFileOriginPolicy);
-      StaticPrefs::security_fileuri_strict_origin_policy_AtStartup());
 }
 
 // SecurityHashURI is consistent with SecurityCompareURIs because
@@ -1541,9 +1541,12 @@ nsScriptSecurityManager::CanGetService(JSContext* cx, const nsCID& aCID) {
 }
 
 const char sJSEnabledPrefName[] = "javascript.enabled";
+const char sFileOriginPolicyPrefName[] =
+    "security.fileuri.strict_origin_policy";
 
-static const char* kObservedPrefs[] = {sJSEnabledPrefName, "capability.policy.",
+static const char* kObservedPrefs[] = {sJSEnabledPrefName,
-                                       nullptr};
+                                       sFileOriginPolicyPrefName,
+                                       "capability.policy.", nullptr};
 
 /////////////////////////////////////////////
 // Constructor, Destructor, Initialization //
@@ -1678,6 +1681,8 @@ inline void nsScriptSecurityManager::ScriptSecurityPrefChanged(
   MOZ_ASSERT(mPrefInitialized);
   mIsJavaScriptEnabled =
       Preferences::GetBool(sJSEnabledPrefName, mIsJavaScriptEnabled);
+  sStrictFileOriginPolicy =
+      Preferences::GetBool(sFileOriginPolicyPrefName, false);
   mFileURIAllowlist.reset();
 }
 

caps/nsScriptSecurityManager.h

@@ -10,8 +10,6 @@
 #include "nsIScriptSecurityManager.h"
 
 #include "mozilla/Maybe.h"
-#include "mozilla/StaticPrefs_security.h"
-
 #include "nsIPrincipal.h"
 #include "nsCOMPtr.h"
 #include "nsServiceManagerUtils.h"
@@ -80,6 +78,8 @@ class nsScriptSecurityManager final : public nsIScriptSecurityManager {
                               bool aFromPrivateWindow,
                               uint64_t aInnerWindowID = 0);
 
+  static bool GetStrictFileOriginPolicy() { return sStrictFileOriginPolicy; }
+
   void DeactivateDomainPolicy();
 
  private:

modules/libpref/init/StaticPrefList.yaml

@@ -15593,9 +15593,9 @@
 
 # Whether strict file origin policy is in effect. "False" is traditional.
 - name: security.fileuri.strict_origin_policy
-  type: bool
+  type: RelaxedAtomicBool
   value: true
-  mirror: once
+  mirror: always
 
 # The level to which we sandbox the content process. firefox.js sets the
 # default to different values on a per-OS basis, and has documentation

netwerk/base/mozurl/MozURL.cpp

@@ -7,7 +7,6 @@
 extern "C" {
 
 bool Gecko_StrictFileOriginPolicy() {
-  return mozilla::StaticPrefs::
+  return mozilla::StaticPrefs::security_fileuri_strict_origin_policy();
-      security_fileuri_strict_origin_policy_AtStartup();
 }
 }