@daleharvey

Can you you elaborate on this:

> We have CSP enabled on the certified apps in which jsonp will not work,
and systemxhr bypasses cors checks but the point is we dont have any apps
that require that functionality, so as you said we shouldnt be adding it or
spending effort thinking about it, as per the first comment

How does the CORS bypass work? The service endpoint is the one that will
allow or disallow the request, so how is it possible? Is there a proxy
that's handling the requests from a different layer in the system?




On Thu, Feb 14, 2013 at 3:37 PM, Dale Harvey <notifications@github.com>wrote:

> In shared/js/lazy_loader.js:
>
> > +      document.head.appendChild(style);
> > +      callback();
> > +    },
> > +
> > +    load: function(files, callback) {
> > +      if (!Array.isArray(files))
> > +        files = [files];
> > +
> > +      var loadsRemaining = files.length, self = this;
> > +      function perFileCallback(file) {
> > +        var node = self._inDOM[file];
> > +        if (node) {
> > +          // Remove the node from the DOM (for cases like JSON-P usage)
> > +          node.parentNode.removeChild(node);
> > +          delete self._inDOM[file];
> > +        }
>
> We have CSP enabled on the certified apps in which jsonp will not work,
> and systemxhr bypasses cors checks but the point is we dont have any apps
> that require that functionality, so as you said we shouldnt be adding it or
> spending effort thinking about it, as per the first comment
> … <#13cda6d41162881c_>
> On 14 February 2013 20:29, Rick Waldron <notifications@github.com> wrote:
> In shared/js/lazy_loader.js: > + document.head.appendChild(style); > +
> callback(); > + }, > + > + load: function(files, callback) { > + if
> (!Array.isArray(files)) > + files = [files]; > + > + var loadsRemaining =
> files.length, self = this; > + function perFileCallback(file) { > + var
> node = self._inDOM[file]; > + if (node) { > + // Remove the node from the
> DOM (for cases like JSON-P usage) > + node.parentNode.removeChild(node); >
> + delete self._inDOM[file]; > + } @daleharvey<https://github.com/daleharvey><
> https://github.com/daleharvey> @mozsquib <https://github.com/mozsquib><
> https://github.com/mozsquib>...what happens if the remote service isn't
> CORS enabled and only offers JSONP? Regardless of whether or not it's a
> security issue, you can still do JSONP with this or anything that loads
> scripts with a script tags. Not removing the script element just means the
> heap will grow with every request. — Reply to this email directly or view
> it on GitHub<https://github.com/mozilla-b2g/gaia/pull/8088/files#r3019597>.
>
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/mozilla-b2g/gaia/pull/8088/files#r3019727>.
>
>