Bug 1550473 - Remove ajv-4.1.1.js from eval()-whitelist. r=ckerschb
authorJonas Allmann <jallmann@mozilla.com>
Mon, 20 May 2019 13:20:16 +0000
changeset 474529 4f2475241df7d23e70c60b427b935e55b1e50df2
parent 474528 93d785b20f991276b2f950eb67308159f97f396f
child 474533 b0234f11a9ef11b1e6a13c26182e441357fbe35c
push id85849
push userbtara@mozilla.com
push dateMon, 20 May 2019 13:28:13 +0000
treeherderautoland@4f2475241df7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersckerschb
bugs1550473
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1550473 - Remove ajv-4.1.1.js from eval()-whitelist. r=ckerschb Allow eval() by flipping pref in all affected test files. Differential Revision: https://phabricator.services.mozilla.com/D31771
modules/libpref/init/all.js
services/sync/tests/unit/test_bookmark_engine.js
services/sync/tests/unit/test_bookmark_order.js
services/sync/tests/unit/test_bookmark_validator.js
services/sync/tests/unit/test_collections_recovery.js
services/sync/tests/unit/test_corrupt_keys.js
services/sync/tests/unit/test_engine_changes_during_sync.js
services/sync/tests/unit/test_errorhandler_1.js
services/sync/tests/unit/test_errorhandler_2.js
services/sync/tests/unit/test_errorhandler_sync_checkServerError.js
services/sync/tests/unit/test_history_engine.js
services/sync/tests/unit/test_hmac_error.js
services/sync/tests/unit/test_node_reassignment.js
services/sync/tests/unit/test_password_engine.js
services/sync/tests/unit/test_service_sync_remoteSetup.js
services/sync/tests/unit/test_service_sync_specified.js
services/sync/tests/unit/test_service_sync_updateEnabledEngines.js
services/sync/tests/unit/test_syncengine_sync.js
services/sync/tests/unit/test_syncscheduler.js
services/sync/tests/unit/test_telemetry.js
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2667,17 +2667,17 @@ pref("security.notification_enable_delay
 
 #if defined(DEBUG) && !defined(ANDROID)
 pref("csp.about_uris_without_csp", "blank,printpreview,srcdoc,about,addons,cache-entry,config,crashes,debugging,devtools,downloads,home,memory,networking,newtab,performance,plugins,policies,profiles,restartrequired,serviceworkers,sessionrestore,support,sync-log,telemetry,url-classifier,webrtc,welcomeback");
 // the following prefs are for testing purposes only.
 pref("csp.overrule_about_uris_without_csp_whitelist", false);
 pref("csp.skip_about_page_has_csp_assert", false);
 // assertion flag will be set to false after fixing Bug 1473549
 pref("security.allow_eval_with_system_principal", false);
-pref("security.uris_using_eval_with_system_principal", "autocomplete.xml,redux.js,react-redux.js,content-task.js,preferencesbindings.js,lodash.js,jszip.js,sinon-7.2.7.js,ajv-4.1.1.js,jsol.js");
+pref("security.uris_using_eval_with_system_principal", "autocomplete.xml,redux.js,react-redux.js,content-task.js,preferencesbindings.js,lodash.js,jszip.js,sinon-7.2.7.js,jsol.js");
 #endif
 
 #if defined(DEBUG) || defined(FUZZING)
 // Disallow web documents loaded with the SystemPrincipal
 pref("security.disallow_non_local_systemprincipal_in_tests", false);
 #endif
 
 // Mixed content blocking
@@ -6048,9 +6048,8 @@ pref("fission.rebuild_frameloaders_on_re
 // true in bug 1550571.
 pref("fission.preserve_browsing_contexts", false);
 
 // Support for legacy customizations that rely on checking the
 // user profile directory for these stylesheets:
 //  * userContent.css
 //  * userChrome.css
 pref("toolkit.legacyUserProfileCustomizations.stylesheets", false);
-
--- a/services/sync/tests/unit/test_bookmark_engine.js
+++ b/services/sync/tests/unit/test_bookmark_engine.js
@@ -3,16 +3,22 @@
 
 const {BookmarkHTMLUtils} = ChromeUtils.import("resource://gre/modules/BookmarkHTMLUtils.jsm");
 const {BookmarkJSONUtils} = ChromeUtils.import("resource://gre/modules/BookmarkJSONUtils.jsm");
 const {SyncedBookmarksMirror} = ChromeUtils.import("resource://gre/modules/SyncedBookmarksMirror.jsm");
 const {OS} = ChromeUtils.import("resource://gre/modules/osfile.jsm");
 const {Bookmark, BookmarkFolder, BookmarksEngine, BufferedBookmarksEngine, Livemark} = ChromeUtils.import("resource://services-sync/engines/bookmarks.js");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 var recordedEvents = [];
 
 function checkRecordedEvents(object, expected, message) {
   // Ignore event telemetry from the merger.
   let repairEvents = recordedEvents.filter(event => event.object == object);
   deepEqual(repairEvents, expected, message);
   // and clear the list so future checks are easier to write.
   recordedEvents = [];
--- a/services/sync/tests/unit/test_bookmark_order.js
+++ b/services/sync/tests/unit/test_bookmark_order.js
@@ -1,16 +1,22 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 _("Making sure after processing incoming bookmarks, they show up in the right order");
 const {Bookmark, BookmarkFolder, BookmarksEngine} = ChromeUtils.import("resource://services-sync/engines/bookmarks.js");
 const {Weave} = ChromeUtils.import("resource://services-sync/main.js");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 async function serverForFoo(engine) {
   await generateNewKeys(Service.collectionKeys);
 
   let clientsEngine = Service.clientsEngine;
   let clientsSyncID = await clientsEngine.resetLocalSyncID();
   let engineSyncID = await engine.resetLocalSyncID();
   return serverForUsers({"foo": "password"}, {
     meta: {
--- a/services/sync/tests/unit/test_bookmark_validator.js
+++ b/services/sync/tests/unit/test_bookmark_validator.js
@@ -1,13 +1,19 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {BookmarkValidator} = ChromeUtils.import("resource://services-sync/bookmark_validator.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 function run_test() {
   do_get_profile();
   run_next_test();
 }
 
 async function inspectServerRecords(data) {
   let validator = new BookmarkValidator();
   return validator.inspectServerRecords(data);
--- a/services/sync/tests/unit/test_collections_recovery.js
+++ b/services/sync/tests/unit/test_collections_recovery.js
@@ -1,14 +1,20 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 // Verify that we wipe the server if we have to regenerate keys.
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 add_task(async function test_missing_crypto_collection() {
   enableValidationPrefs();
 
   let johnHelper = track_collections_helper();
   let johnU      = johnHelper.with_updated_collection;
   let johnColls  = johnHelper.collections;
 
   let empty = false;
--- a/services/sync/tests/unit/test_corrupt_keys.js
+++ b/services/sync/tests/unit/test_corrupt_keys.js
@@ -1,16 +1,22 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Weave} = ChromeUtils.import("resource://services-sync/main.js");
 const {HistoryEngine} = ChromeUtils.import("resource://services-sync/engines/history.js");
 const {CryptoWrapper, WBORecord} = ChromeUtils.import("resource://services-sync/record.js");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 add_task(async function test_locally_changed_keys() {
   enableValidationPrefs();
 
   let hmacErrorCount = 0;
   function counting(f) {
     return async function() {
       hmacErrorCount++;
       return f.call(this);
--- a/services/sync/tests/unit/test_engine_changes_during_sync.js
+++ b/services/sync/tests/unit/test_engine_changes_during_sync.js
@@ -1,16 +1,22 @@
 const {FormHistory} = ChromeUtils.import("resource://gre/modules/FormHistory.jsm");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {Bookmark, BookmarkFolder, BookmarkQuery} = ChromeUtils.import("resource://services-sync/engines/bookmarks.js");
 const {HistoryRec} = ChromeUtils.import("resource://services-sync/engines/history.js");
 const {FormRec} = ChromeUtils.import("resource://services-sync/engines/forms.js");
 const {LoginRec} = ChromeUtils.import("resource://services-sync/engines/passwords.js");
 const {PrefRec} = ChromeUtils.import("resource://services-sync/engines/prefs.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 const LoginInfo = Components.Constructor(
   "@mozilla.org/login-manager/loginInfo;1", Ci.nsILoginInfo, "init");
 
 /**
  * We don't test the clients or tabs engines because neither has conflict
  * resolution logic. The clients engine syncs twice per global sync, and
  * custom conflict resolution logic for commands that doesn't use
  * timestamps. Tabs doesn't have conflict resolution at all, since it's
--- a/services/sync/tests/unit/test_errorhandler_1.js
+++ b/services/sync/tests/unit/test_errorhandler_1.js
@@ -1,14 +1,20 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {Status} = ChromeUtils.import("resource://services-sync/status.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 const fakeServer = new SyncServer();
 fakeServer.start();
 const fakeServerUrl = "http://localhost:" + fakeServer.port;
 
 registerCleanupFunction(function() {
   return promiseStopServer(fakeServer).finally(() => {
     Svc.Prefs.resetBranch("");
   });
--- a/services/sync/tests/unit/test_errorhandler_2.js
+++ b/services/sync/tests/unit/test_errorhandler_2.js
@@ -1,15 +1,21 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {Status} = ChromeUtils.import("resource://services-sync/status.js");
 const {FileUtils} = ChromeUtils.import("resource://gre/modules/FileUtils.jsm");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 const fakeServer = new SyncServer();
 fakeServer.start();
 const fakeServerUrl = "http://localhost:" + fakeServer.port;
 
 registerCleanupFunction(function() {
   return promiseStopServer(fakeServer).finally(() => {
     Svc.Prefs.resetBranch("");
   });
--- a/services/sync/tests/unit/test_errorhandler_sync_checkServerError.js
+++ b/services/sync/tests/unit/test_errorhandler_sync_checkServerError.js
@@ -1,15 +1,21 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {Status} = ChromeUtils.import("resource://services-sync/status.js");
 const {FakeCryptoService} = ChromeUtils.import("resource://testing-common/services/sync/fakeservices.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 var engineManager = Service.engineManager;
 
 function CatapultEngine() {
   SyncEngine.call(this, "Catapult", Service);
 }
 CatapultEngine.prototype = {
   __proto__: SyncEngine.prototype,
   exception: null, // tests fill this in
--- a/services/sync/tests/unit/test_history_engine.js
+++ b/services/sync/tests/unit/test_history_engine.js
@@ -1,14 +1,20 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {HistoryEngine} = ChromeUtils.import("resource://services-sync/engines/history.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 // Use only for rawAddVisit.
 XPCOMUtils.defineLazyServiceGetter(this, "asyncHistory",
                                    "@mozilla.org/browser/history;1",
                                    "mozIAsyncHistory");
 async function rawAddVisit(id, uri, visitPRTime, transitionType) {
   return new Promise((resolve, reject) => {
     let results = [];
     let handler = {
--- a/services/sync/tests/unit/test_hmac_error.js
+++ b/services/sync/tests/unit/test_hmac_error.js
@@ -1,13 +1,19 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 // Track HMAC error counts.
 var hmacErrorCount = 0;
 (function() {
   let hHE = Service.handleHMACEvent;
   Service.handleHMACEvent = async function() {
     hmacErrorCount++;
     return hHE.call(Service);
   };
--- a/services/sync/tests/unit/test_node_reassignment.js
+++ b/services/sync/tests/unit/test_node_reassignment.js
@@ -3,16 +3,21 @@
 
 _("Test that node reassignment responses are respected on all kinds of " +
   "requests.");
 
 const {RESTRequest} = ChromeUtils.import("resource://services-common/rest.js");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {PromiseUtils} = ChromeUtils.import("resource://gre/modules/PromiseUtils.jsm");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
 
 add_task(async function setup() {
   validate_all_future_pings();
 });
 
 /**
  * Emulate the following Zeus config:
  * $draining = data.get($prefix . $host . " draining");
--- a/services/sync/tests/unit/test_password_engine.js
+++ b/services/sync/tests/unit/test_password_engine.js
@@ -1,12 +1,18 @@
 const {FXA_PWDMGR_HOST, FXA_PWDMGR_REALM} = ChromeUtils.import("resource://gre/modules/FxAccountsCommon.js");
 const {LoginRec} = ChromeUtils.import("resource://services-sync/engines/passwords.js");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 const LoginInfo = Components.Constructor(
   "@mozilla.org/login-manager/loginInfo;1", Ci.nsILoginInfo, "init");
 
 const PropertyBag = Components.Constructor(
   "@mozilla.org/hash-property-bag;1", Ci.nsIWritablePropertyBag);
 
 async function cleanup(engine, server) {
   await engine._tracker.stop();
--- a/services/sync/tests/unit/test_service_sync_remoteSetup.js
+++ b/services/sync/tests/unit/test_service_sync_remoteSetup.js
@@ -1,13 +1,19 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 add_task(async function run_test() {
   enableValidationPrefs();
 
   validate_all_future_pings();
   Log.repository.rootLogger.addAppender(new Log.DumpAppender());
 
   let clients = new ServerCollection();
   let meta_global = new ServerWBO("global");
--- a/services/sync/tests/unit/test_service_sync_specified.js
+++ b/services/sync/tests/unit/test_service_sync_specified.js
@@ -1,13 +1,19 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 let syncedEngines = [];
 
 function SteamEngine() {
   SyncEngine.call(this, "Steam", Service);
 }
 SteamEngine.prototype = {
   __proto__: SyncEngine.prototype,
   async _sync() {
--- a/services/sync/tests/unit/test_service_sync_updateEnabledEngines.js
+++ b/services/sync/tests/unit/test_service_sync_updateEnabledEngines.js
@@ -1,13 +1,19 @@
 /* Any copyright is dedicated to the Public Domain.
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 function QuietStore() {
   Store.call("Quiet");
 }
 QuietStore.prototype = {
   async getAllIDs() {
     return [];
   },
 };
--- a/services/sync/tests/unit/test_syncengine_sync.js
+++ b/services/sync/tests/unit/test_syncengine_sync.js
@@ -1,16 +1,22 @@
 /* Any copyright is dedicated to the Public Domain.
  * http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {Weave} = ChromeUtils.import("resource://services-sync/main.js");
 const {WBORecord} = ChromeUtils.import("resource://services-sync/record.js");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {RotaryEngine} = ChromeUtils.import("resource://testing-common/services/sync/rotaryengine.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 function makeRotaryEngine() {
   return new RotaryEngine(Service);
 }
 
 async function clean(engine) {
   Svc.Prefs.resetBranch("");
   Svc.Prefs.set("log.logger.engine.rotary", "Trace");
   Service.recordManager.clearCache();
--- a/services/sync/tests/unit/test_syncscheduler.js
+++ b/services/sync/tests/unit/test_syncscheduler.js
@@ -2,16 +2,22 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 const {FxAccounts} = ChromeUtils.import("resource://gre/modules/FxAccounts.jsm");
 const {BrowserIDManager} = ChromeUtils.import("resource://services-sync/browserid_identity.js");
 const {SyncScheduler} = ChromeUtils.import("resource://services-sync/policies.js");
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {Status} = ChromeUtils.import("resource://services-sync/status.js");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
 function CatapultEngine() {
   SyncEngine.call(this, "Catapult", Service);
 }
 CatapultEngine.prototype = {
   __proto__: SyncEngine.prototype,
   exception: null, // tests fill this in
   async _sync() {
     throw this.exception;
--- a/services/sync/tests/unit/test_telemetry.js
+++ b/services/sync/tests/unit/test_telemetry.js
@@ -3,16 +3,23 @@
 
 const {Service} = ChromeUtils.import("resource://services-sync/service.js");
 const {WBORecord} = ChromeUtils.import("resource://services-sync/record.js");
 const {Resource} = ChromeUtils.import("resource://services-sync/resource.js");
 const {BookmarksEngine} = ChromeUtils.import("resource://services-sync/engines/bookmarks.js");
 const {RotaryEngine} = ChromeUtils.import("resource://testing-common/services/sync/rotaryengine.js");
 const {OS} = ChromeUtils.import("resource://gre/modules/osfile.jsm");
 
+// Allow eval to avoid triggering the eval()-assertion through ajv-4.1.1.js
+Services.prefs.setBoolPref("security.allow_eval_with_system_principal", true);
+registerCleanupFunction(() => {
+  Services.prefs.clearUserPref("security.allow_eval_with_system_principal");
+});
+
+
 function SteamStore(engine) {
   Store.call(this, "Steam", engine);
 }
 
 SteamStore.prototype = {
   __proto__: Store.prototype,
 };