1175480 - Expose the external content policy type from the load info objects

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[(no longer active)]

Consumers of this type need to deal with the external content policy
types.  One example is HttpObserverManager.runChannelListener in
WebRequest.jsm.

Comment 1

[(no longer active)]

Attachment: Expose the external content policy type from the load info objects

Comment 2

[(no longer active)]

Attachment: Expose the external content policy type from the load info objects

Consumers of this type need to deal with the external content policy
types.  One example is HttpObserverManager.runChannelListener in
WebRequest.jsm.

Comment 3

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8623611 [details] [diff] [review]
Expose the external content policy type from the load info objects

We really should have some other type for _INTERNAL_ to make it clear when one
deals with internal and when external contentpolicytypes.
But that is not about this bug.

>   /**
>-   * The contentPolicyType of the channel, used for security checks
>+   * The external contentPolicyType of the channel, used for security checks
>    * like Mixed Content Blocking and Content Security Policy.
>    */
Could you still emphasize that _INTERNAL_ values aren't ever returned.



>   /**
>+   * The internal contentPolicyType of the channel, used for constructing
>+   * RequestContext values when creating a fetch event for an intercepted
>+   * channel.
>+   *
>+   * This should not be used for the purposes of security checks.  Please
>+   * use the contentPolicyType attribute above for that purpose.
Why this shouldn't be used for security checks?
I would just drop the latter paragraph (or explain why this shouldn't be used for security checks).

Comment 4

[(no longer active)]

(In reply to Olli Pettay [:smaug] from comment #3)
> >   /**
> >+   * The internal contentPolicyType of the channel, used for constructing
> >+   * RequestContext values when creating a fetch event for an intercepted
> >+   * channel.
> >+   *
> >+   * This should not be used for the purposes of security checks.  Please
> >+   * use the contentPolicyType attribute above for that purpose.
> Why this shouldn't be used for security checks?

Because the content policy implementations are only expected to be able to deal with external types.

> I would just drop the latter paragraph (or explain why this shouldn't be
> used for security checks).

I'll explain more in the comment.

Comment 5

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/b2c472fe14ca

Comment 6

[Carsten Book [:Tomcat]]

sorry had to back this out again, seems this and the other landing caused test failures like https://treeherder.mozilla.org/logviewer.html#?job_id=10918636&repo=mozilla-inbound

Comment 7

[Pulsebot]

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f1f1a9a1c46a

Comment 8

[(no longer active)]

This should be innocent.  Relanded: https://hg.mozilla.org/integration/mozilla-inbound/rev/2d456668f53c

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/2d456668f53c