+++ This bug was initially created as a clone of Bug #1035091 +++ Bug 1035091 landed the code on early Beta and Nightly. We should switch the pref in this one.

Comment on attachment 8959997 [details] Bug 1422245 Disable @-moz-document in content pages https://reviewboard.mozilla.org/r/228778/#review234480 Hah, so... This is fine I suppose. There's still some breakage from it (most notably Youtube comments, bug 1426068), and all of them were using `@-moz-document url-prefix()` for that, so I think we should still parse it on content pages. Curiously I filed bug 1446470 on that 2 days ago, and that includes this patch. Let's land this for now, I'll rebase my patches on top. Maybe mention that bug on the commit message? Thanks!

(Or we can land this after those patches, and I'll remove part 3 on that bug, your call).

Posted the site compatibility note: https://www.fxsitecompat.com/en-CA/docs/2018/moz-document-has-been-dropped/

(In reply to Kohei Yoshino [:kohei] from comment #5) > Posted the site compatibility note: > https://www.fxsitecompat.com/en-CA/docs/2018/moz-document-has-been-dropped/ Beware of bug 1446470, which will fix all the known breakages so far too, and is intended to land in time for the same firefox release. That bug means that @-moz-document url-prefix() { } will keep working.

So no security issues will be solved here? This bug can be simply WONTFIXed then... :(

Wait, what? Yes. The security issue is with other url matching functions, like regex(..), which this patch forbids. We'll just allow an empty url-prefix to avoid breaking websites.

Thanks for the clarification. Updating the note accordingly.

Pushed by rgurzau@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/a83ccbf8a6b6 Disable @-moz-document in content pages r=emilio

(In reply to Emilio Cobos Álvarez [:emilio] from comment #6) > (In reply to Kohei Yoshino [:kohei] from comment #5) > > Posted the site compatibility note: > > https://www.fxsitecompat.com/en-CA/docs/2018/moz-document-has-been-dropped/ > > Beware of bug 1446470, which will fix all the known breakages so far too, > and is intended to land in time for the same firefox release. > > That bug means that @-moz-document url-prefix() { } will keep working. We should probably post an update to the Intent to unship thread in dev-platform about this plan as well.

I've updated the compat data to capture this: https://developer.mozilla.org/en-US/docs/Web/CSS/@document#Browser_compatibility Marking dev-doc-complete, but please comment if we need anything else.

(In reply to Will Bamberg [:wbamberg] from comment #13) > I've updated the compat data to capture this: > https://developer.mozilla.org/en-US/docs/Web/CSS/ > @document#Browser_compatibility > > Marking dev-doc-complete, but please comment if we need anything else. I also added a rel note: https://developer.mozilla.org/en-US/Firefox/Releases/61#CSS