News for hackers. Stuff that matters.

A comment on Hardening the Firefox Front End with Content Security Policies. Parent comment

Re:Hardening the Firefox Front End with Content Security Pol... by emiliocobos on Wednesday April 09, 2025 @09:12AM (#43631677)
Xul would've had the same issues.
[ Parent | on HN ]
Re:Hardening the Firefox Front End with Content Security Pol... by sebazzz on Wednesday April 09, 2025 @12:14PM (#43633749)
It still surprises me parts of Firefox still use XUL.
[ Parent | on HN ]
Re:Hardening the Firefox Front End with Content Security Pol... by WorldMaker on Wednesday April 09, 2025 @10:03AM (#43632263)
XUL would have had worse issues because it could make arbitrary XPCOM calls to all sorts of native components and nearly the full gamut of native component issues written mostly in C/C++.

XUL was in many ways always a ticking time bomb.

[ Parent | on HN ]
Re:Hardening the Firefox Front End with Content Security Pol... by fabrice_d on Wednesday April 09, 2025 @07:33PM (#43639122)
The current frontend still has the same XPCOM privilege access from JS, so as emiliocobos said, XUL vs. HTML does not change the security boundary. It's only a different markup language.
[ Parent | on HN ]