Apparently Mozilla completely spaced out on this when adding the CSP nonce
mechanism, potentially causing web compat issues if scripting relies on
being able to get/set nonces through DOM and/or causing CSP policy check
issues if websites try to "hide" nonces.
The removal of this preference was botched, all other surrounding plumbing changes appear to be working okay. The ability to use prefs to control this stylesheet might be useful in the future, so perhaps this is one of those "if it ain't broke, don't fix it" bugs where leaving well enough alone in the first place would have been the best choice.
Since these are just interpreted comments, there's 0 impact on actual code.
This removes all lines that match /* vim: set(.*)tw=80: */ with S&R -- there are
a few others scattered around which will be removed manually in a second part.
Unless a user is debugging media errors, this detail is unnecessary to report
and could include sensitive data which could be abused by third-party
requesters. This aligns it with the standard success/error paradigms in normal
browsing situations.
This commit does several things:
- Moves the pref check from ScriptLoader to ns[I]Document so it can be called on
the document.
- Changes the atrribute freezing function to a better name that takes the
document as a parameter.
- Sets the proper async/defer attributes on HTML script elements based on
keywords and whether they are module scripts or not.
This is not very "clean," and is mostly done in the same sloppy way as Emilio did it because that's basically the only way you can do it. Note well that this does NOT actually turn off everything I've done in a clean fashion like ifdefs would. For instance, the Explicitly Enabled flag is still present, but is now always false because the only condition that can set it true is behind the pref and therefore inert when this pref is off. Also, because the arguments of SetDisabled have changed, my modifications to SetMozDisabled must be present regardless of whether the pref is on or off. What I have done is turn off the actual reflection of the disabled attribute in Disabled and SetDisabled, as well as in AfterSetAttr.
However, turning the pref off seems to restore more or less our old behavior, though there may be subtle differences unlike with an ifdef since this is, unfortunately, not an exact science and I can only turn off changes that happen within individual functions and not changes in how functions interact with each other.
This part of the bug was significantly complicated by the following major refactors:
https://bugzilla.mozilla.org/show_bug.cgi?id=1456435https://bugzilla.mozilla.org/show_bug.cgi?id=1459498
As best as I can tell, we just need to implement the explicitly enabled
flag on every instance of GetStyleSheetInfo, make sure
aIsExplicitlyEnabled is false in every situation except the one where
the disabled content attribute is removed from a link element, and
enable alternate stylesheets if this flag is set on them. So we take the
explicitly enabled flag as an input to PrepareSheet, and also add it to
LoadStyleLink and LoadInlineStyle. I also decided not to defer loading of
alternate stylesheets that have been explicitly enabled.
So basically, I'm trying to adapt this to UXP:
https://bugzilla.mozilla.org/show_bug.cgi?id=1281135
The earliest source of difficulty while adapting Bug 1281135 to our codebase was simply getting the new ErrorResult flag added to the SetDisabled function to play nice with the SetMozDisabled function. At this point, the implementation can actually have a stylesheet be disabled by default but there are supposedly issues with alternate stylesheets.
At first I played around with the return type of SetMozDisabled to no avail, but I found another solution fairly quickly.
https://bugzilla.mozilla.org/show_bug.cgi?id=846972https://bugzilla.mozilla.org/show_bug.cgi?id=1157898
Essentially, the way around the problem of the number of return arguments not matching up is to declare a local variable within SetMozDisabled called ErrorResult rv, and using that to store the return value of the ErrorResult argument from SetDisabled. After that, because ErrorCode was removed, you would return rv.StealNSResult() in order to report success or failure to any consumer that calls on SetMozDisabled.
