Per the CSP specification, content injected by extensions is meant to
be exempt from page CSP. This patch takes care of the most common case
of content injected by extension content scripts, which always have
expanded principals which inherit from the page principal.
To make this easier, de-virtualize BasePrincipal::Kind(), using CTOR
initializers instead.
This removes a lot of the plumbing for having the platform embed itself
through IPC which was required for B2G running the browser as both
shell and browser application.
Manual checking of the origins in SecFetch fails, so we add this
capability to the base principal interface for sake of ease.
We could use ScriptSecurityManager directly but it's more convenient
this way and can be re-used elsewhere in the future.
Vim control lines were re-introduced or not entirely cleaned up.
This nukes them again.
Removing from the rest of js, caps, chrome, config, devtools, docshell,
image, intl. More to come.
In UXP Moonchild changed the implications for this security bug so it actually didn't do what Mozilla intended in an attempt to preserve functionality internally. He failed on both counts. This fix denies web access to any moz-icon but allows it to still work on other protocols like file: and about: etc.
We may want to re-visit the second part of our commit sha 6fa154c0adc64bd43775a79b7b508d87a486882b
Regardless, it seems to now perform as it was intended while not breaking stuff internally.
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
