In early November, a bunch of folks, some of whom I'm probably forgetting, including Standard8, dveditz, jst, sicking, mrbkap, bienvenu, bz, davida, and me met to figure out what to do. We ultimately came to a number of conclusions:
- we could live with prefs (mostly defaulted to off) that folks who were tolerant of high degrees of risk could turn on, similar to the way codebase principal support works.
- more and more blogs are embedding JS-based web widgetry of various sorts
- we could display that content in a browser-like context, which is well understood and supported by Gecko for handling JS with appropriate risk-mitigation features
- feeds need to be explicitly opted into, which makes their risk profile very slightly safer than sources of arbitrary messages (though very much not risk-free, as philor has pointed out)
- we should turn off JS/XBL in the compose window entirely
- we should notice when the user flips any of the prefs to on, and at the very least point them to some web-content describing what risks they were taking
- we should audit that forwarding messages disables or strips any script
After that, I spent a bunch of time hacking, and came up with the patches in bug 374577, which are reviewed and need a bit more cleanup. There is one patch for mozilla-central, and one for comm-central, but there are really three pieces of functionality:
- adds code to nsMsgContentPolicy so that docshells loading message URLs turn off JS at the start of the load
- once the message load is sufficiently far along, a preference is checked to see if JS should be allowed for messages that were "first seen" in a specific context (one of nntp, mail, feed-summary, feed-summarized-page) and, if so, reenabled
- removes the special-casing of mailnews from nsScriptSecurityManager, since the above two hunks obviate the need for it. Note that unlike before, loads that aren't message URLs now allow JS by default. This is important for extensions that want to integrate with the web in interesting ways (eg displaying web pages in iframes).