--- a/security/manager/.eslintrc.json
+++ b/security/manager/.eslintrc.json
@@ -130,16 +130,19 @@
 
     // Disallow throwing literals (eg. |throw "error"| instead of
     // |throw new Error("error")|)
     "no-throw-literal": 2,
 
     // No trailing whitespace
     "no-trailing-spaces": 2,
 
+    // No using undeclared variables
+    "no-undef": 2,
+
     // Error on newline where a semicolon is needed
     "no-unexpected-multiline": 2,
 
     // No unreachable statements
     "no-unreachable": 2,
 
     // No expressions where a statement is expected
     "no-unused-expressions": 2,
@@ -174,10 +177,17 @@
     // ++ and -- should not need spacing
     "space-unary-ops": [2, { "words": true, "nonwords": false }],
 
     // No comparisons to NaN
     "use-isnan": 2,
 
     // Only check typeof against valid results
     "valid-typeof": 2
+  },
+  "env": {
+    "browser": true
+  },
+  "globals": {
+    "Components": false,
+    "dump": false
   }
 }

--- a/security/manager/pki/resources/content/certManager.js
+++ b/security/manager/pki/resources/content/certManager.js
@@ -1,11 +1,12 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 const nsIFilePicker = Components.interfaces.nsIFilePicker;
 const nsFilePicker = "@mozilla.org/filepicker;1";
 const nsIX509CertDB = Components.interfaces.nsIX509CertDB;
 const nsX509CertDB = "@mozilla.org/security/x509certdb;1";
 const nsIX509Cert = Components.interfaces.nsIX509Cert;
 const nsICertTree = Components.interfaces.nsICertTree;
 const nsCertTree = "@mozilla.org/security/nsCertTree;1";

--- a/security/manager/pki/resources/content/certpicker.js
+++ b/security/manager/pki/resources/content/certpicker.js
@@ -1,12 +1,13 @@
 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 
 var dialogParams;
 var itemCount = 0;
 
 function onLoad()
 {

--- a/security/manager/pki/resources/content/choosetoken.js
+++ b/security/manager/pki/resources/content/choosetoken.js
@@ -1,14 +1,14 @@
 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
+/* import-globals-from pippki.js */
 
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 
 var dialogParams;
 
 function onLoad()
 {
   dialogParams = window.arguments[0].QueryInterface(nsIDialogParamBlock);

--- a/security/manager/pki/resources/content/clientauthask.js
+++ b/security/manager/pki/resources/content/clientauthask.js
@@ -1,14 +1,14 @@
 /* -*- tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*-
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
+/* import-globals-from pippki.js */
 
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 
 var dialogParams;
 var itemCount = 0;
 var rememberBox;
 
 function onLoad()

--- a/security/manager/pki/resources/content/createCertInfo.js
+++ b/security/manager/pki/resources/content/createCertInfo.js
@@ -1,37 +1,38 @@
 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
  *
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 var keygenThread;
 
 function onLoad()
 {
   keygenThread = window.arguments[0].QueryInterface(Components.interfaces.nsIKeygenThread);
 
   if (!keygenThread) {
     window.close();
     return;
   }
 
-  setCursor("wait");
+  window.setCursor("wait");
 
   var obs = {
     observe : function keygenListenerObserve(subject, topic, data) {
       if (topic == "keygen-finished") {
         window.close();
       }
     }
   };
 
   keygenThread.startKeyGeneration(obs);
 }
 
 function onClose()
 {
-  setCursor("default");
+  window.setCursor("auto");
 
   var alreadyClosed = {};
   keygenThread.userCanceled(alreadyClosed);
 }

--- a/security/manager/pki/resources/content/deletecert.js
+++ b/security/manager/pki/resources/content/deletecert.js
@@ -1,11 +1,12 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 const nsIX509Cert = Components.interfaces.nsIX509Cert;
 const nsX509CertDB = "@mozilla.org/security/x509certdb;1";
 const nsIX509CertDB = Components.interfaces.nsIX509CertDB;
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 
 var certdb;
 var gParams;

--- a/security/manager/pki/resources/content/downloadcert.js
+++ b/security/manager/pki/resources/content/downloadcert.js
@@ -1,11 +1,12 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 const nsIX509Cert = Components.interfaces.nsIX509Cert;
 
 var params;
 var caName;
 var cert;
 

--- a/security/manager/pki/resources/content/editcerts.js
+++ b/security/manager/pki/resources/content/editcerts.js
@@ -1,11 +1,12 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 const nsIX509Cert = Components.interfaces.nsIX509Cert;
 const nsX509CertDB = "@mozilla.org/security/x509certdb;1";
 const nsIX509CertDB = Components.interfaces.nsIX509CertDB;
 
 var certdb;
 var cert;
 

--- a/security/manager/pki/resources/content/exceptionDialog.js
+++ b/security/manager/pki/resources/content/exceptionDialog.js
@@ -1,12 +1,12 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
+/* import-globals-from pippki.js */
 
 var gDialog;
 var gBundleBrand;
 var gPKIBundle;
 var gSSLStatus;
 var gCert;
 var gChecking;
 var gBroken;

--- a/security/manager/pki/resources/content/protectedAuth.js
+++ b/security/manager/pki/resources/content/protectedAuth.js
@@ -1,29 +1,30 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 function onLoad()
 {
-  protectedAuthThread =
+  let protectedAuthThread =
     window.arguments[0].QueryInterface(Components.interfaces.nsIProtectedAuthThread);
 
   if (!protectedAuthThread) {
     window.close();
     return;
   }
 
   try {
     let tokenName = protectedAuthThread.getTokenName();
 
     let tag = document.getElementById("tokenName");
     tag.setAttribute("value", tokenName);
 
-    setCursor("wait");
+    window.setCursor("wait");
 
     let obs = {
       observe: function protectedAuthListenerObserve(subject, topic, data) {
         if (topic == "operation-completed") {
           window.close();
         }
       }
     };
@@ -31,10 +32,10 @@ function onLoad()
     protectedAuthThread.login(obs);
   } catch (exception) {
     window.close();
   }
 }
 
 function onClose()
 {
-  setCursor("default");
+  window.setCursor("auto");
 }

--- a/security/manager/pki/resources/content/resetpassword.js
+++ b/security/manager/pki/resources/content/resetpassword.js
@@ -1,11 +1,12 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* import-globals-from pippki.js */
 
 const nsPK11TokenDB = "@mozilla.org/security/pk11tokendb;1";
 const nsIPK11TokenDB = Components.interfaces.nsIPK11TokenDB;
 const nsIDialogParamBlock = Components.interfaces.nsIDialogParamBlock;
 
 var tokenName;
 
 function onLoad()

new file mode 100644
--- /dev/null
+++ b/security/manager/ssl/tests/mochitest/browser/.eslintrc.json
@@ -0,0 +1,3 @@
+{
+  "extends": "../../../../../../testing/mochitest/browser.eslintrc"
+}

new file mode 100644
--- /dev/null
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/.eslintrc.json
@@ -0,0 +1,3 @@
+{
+  "extends": "../../../../../../testing/mochitest/mochitest.eslintrc"
+}

--- a/security/manager/ssl/tests/mochitest/mixedcontent/bug329869.js
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/bug329869.js
@@ -1,4 +1,5 @@
+/* import-globals-from mixedContentTest.js */
 document.open();
 document.write("This is insecure XSS script " + document.cookie);
 isSecurityState("broken", "security broken after document write from unsecure script");
 finish();

--- a/security/manager/ssl/tests/mochitest/mixedcontent/bug383369step2.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/bug383369step2.html
@@ -2,16 +2,17 @@
 <html>
 <head>
   <title>Bug 383369 test, step 2</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/does_not_exist.css">
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   window.onload = function runTest() {
     window.setTimeout(function () {
       window.location =
         "https://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/bug383369step3.html?runtest";
     }, 0);
   };
 

--- a/security/manager/ssl/tests/mochitest/mixedcontent/bug383369step3.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/bug383369step3.html
@@ -2,16 +2,17 @@
 <html>
 <head>
   <title>Bug 383369 test, final step</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("secure", "secure page after insecure download and insecure subcontent still secure");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/mixedContentTest.js
@@ -29,32 +29,36 @@ var hasMixedActiveContent = false;
 
 // Internal variables
 var _windowCount = 0;
 
 window.onload = function onLoad() {
   if (location.search == "?runtest") {
     try {
       if (history.length == 1) {
-        runTest();
+        // Each test that includes this helper file is supposed to define
+        // runTest(). See the top level comment.
+        runTest(); // eslint-disable-line no-undef
       } else {
-        afterNavigationTest();
+        // Each test that includes this helper file is supposed to define
+        // afterNavigationTest(). See the top level comment.
+        afterNavigationTest(); // eslint-disable-line no-undef
       }
     } catch (ex) {
       ok(false, "Exception thrown during test: " + ex);
       finish();
     }
   } else {
     window.addEventListener("message", onMessageReceived, false);
 
     let secureTestLocation = loadAsInsecure ? "http://example.com"
                                             : "https://example.com";
     secureTestLocation += location.pathname;
     if (testPage != "") {
-      array = secureTestLocation.split("/");
+      let array = secureTestLocation.split("/");
       array.pop();
       array.push(testPage);
       secureTestLocation = array.join("/");
     }
     secureTestLocation += "?runtest";
 
     if (hasMixedActiveContent) {
       SpecialPowers.pushPrefEnv(

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_bug329869.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_bug329869.html
@@ -2,16 +2,17 @@
 <html>
 <head>
   <title>dymanic script load</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("secure");
     window.setTimeout(function () {
       var newElement = document.createElement("script");

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_bug383369.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_bug383369.html
@@ -2,16 +2,17 @@
 <html>
 <head>
   <title>Bug 383369 test</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   // We want to start this test from an insecure context
   loadAsInsecure = true;
   // We don't want to go through the navigation back/forward test
   bypassNavigationTest = true;
 
   function runTest()
   {

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_bug455367.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_bug455367.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("broken", "broken");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_bug472986.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_bug472986.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   SimpleTest.expectAssertions(0, 4);
 
   // Clear the default onload assigned to test start because we must
   // wait for replaced image to load and only after that test the security state
   var onLoadFunction = window.onload;
   window.onload = function()
   {

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_bug477118.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_bug477118.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("secure", "data <img> doesn't break security");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_bug521461.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_bug521461.html
@@ -6,17 +6,18 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
-    
+  /* import-globals-from mixedContentTest.js */
+
   loadAsInsecure = true;
 
   function runTest()
   {
     window.location = "https://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/nocontent.sjs";
     window.setTimeout(function() {
       isSecurityState("insecure", "location.href doesn't effect the security state");
       is(document.body.innerHTML, "This is an unsecure page!", "Document has not changed content");

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_cssBefore1.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_cssBefore1.html
@@ -12,16 +12,17 @@
   <style type="text/css">
     p:before
     {
       content: url(http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg);
     }
   </style>
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("broken", "insecure content added by :before styling breaks security");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_cssContent1.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_cssContent1.html
@@ -13,16 +13,17 @@
   <style type="text/css">
     p
     {
       content: url(http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg);
     }
   </style>
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("broken", "insecure content added by :before styling breaks security");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_cssContent2.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_cssContent2.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   if (navigator.platform.startsWith("Mac")) {
     SimpleTest.expectAssertions(0, 1);
   }
 
   function runTest()
   {
     isSecurityState("secure");

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_documentWrite1.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_documentWrite1.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("broken", "insecure <img> written dynamically breaks security");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_documentWrite2.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_documentWrite2.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("broken", "insecure iframe written dynamically breaks security");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_dynDelayedUnsecurePicture.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_dynDelayedUnsecurePicture.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("secure");
     window.setTimeout(function() {
       // Don't do this synchronously from onload handler
       document.getElementById("image1").src =
         "http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg";

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_dynDelayedUnsecureXHR.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_dynDelayedUnsecureXHR.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("secure");
     window.setTimeout(() => {
       try {

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecureBackground.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecureBackground.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   // This test, as is, equals to https://kuix.de/misc/test17/358438.php
 
   function runTest()
   {
     isSecurityState("secure");
     document.body.background =
       "http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg";

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecureIframeRedirect.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecureIframeRedirect.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("secure");
     var self = window;
     var iframe = document.getElementById("iframe1");

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecurePicture.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecurePicture.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   // This test, as is, equals to https://kuix.de/misc/test17/358438.php
 
   function runTest()
   {
     isSecurityState("secure");
     document.getElementById("image1").src =
       "http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg";

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecurePicturePreload.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecurePicturePreload.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   (new Image()).src =
     "http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg";
 
   function runTest()
   {
     isSecurityState("broken", "(new Image()).src='http://...' changed to broken");
     finish();

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecureRedirect.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_dynUnsecureRedirect.html
@@ -2,16 +2,17 @@
 <html>
 <head>
   <title>img.src changes to unsecure redirect test</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("secure");
     document.getElementById("image1").src =
       "https://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/imgunsecredirect.sjs";
 
     window.setTimeout(function() {

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_innerHtmlDelayedUnsecurePicture.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_innerHtmlDelayedUnsecurePicture.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("secure");
 
     window.setTimeout(function () {
       document.getElementById("buddy").innerHTML =
         "<img id='image1' src='http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg' />";

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_innerHtmlUnsecurePicture.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_innerHtmlUnsecurePicture.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("secure");
 
     document.getElementById("buddy").innerHTML =
       "<img id='image1' src='http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/moonsurface.jpg' />";
 

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_javascriptPicture.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_javascriptPicture.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("secure", "javascript: <img> should not break security");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_secureAll.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_secureAll.html
@@ -5,20 +5,21 @@
   <script type="text/javascript" src="/MochiKit/Base.js"></script>
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
-  <link rel="stylesheet" type="text/css" 
+  <link rel="stylesheet" type="text/css"
     href="https://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/somestyle.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   // Navigation test goes over an insecure page, test state leak
   navigateToInsecure = true;
 
   function runTest()
   {
     isSecurityState("secure", "insecure <img> load breaks security");
     finish();

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_securePicture.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_securePicture.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   loadAsInsecure = true;
 
   function runTest()
   {
     isSecurityState("insecure", "left insecure");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureBackground.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureBackground.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   // This test, as is, equals to https://kuix.de/misc/test17/358438.php
 
   function runTest()
   {
     isSecurityState("broken", "security broken");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureCSS.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureCSS.html
@@ -4,21 +4,22 @@
   <title>Unsecure css load</title>
   <script type="text/javascript" src="/MochiKit/Base.js"></script>
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-  
-  <link rel="stylesheet" type="text/css" 
+
+  <link rel="stylesheet" type="text/css"
     href="http://example.com/tests/security/manager/ssl/tests/mochitest/mixedcontent/somestyle.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("broken", "insecure <img> load breaks security");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframe.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframe.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("broken", "insecure <iframe> load breaks security");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframe2.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframe2.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("broken", "insecure <iframe> load breaks security");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframeMetaRedirect.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframeMetaRedirect.html
@@ -2,16 +2,17 @@
 <html>
 <head>
   <title>Unsecure redirect iframe load</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     window.setTimeout(function()
     {
       isSecurityState("broken", "insecure meta-tag <iframe> load breaks security");
       finish();
     }, 500);

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframeRedirect.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureIframeRedirect.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("broken", "insecure <iframe> load breaks security");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecurePicture.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecurePicture.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   function runTest()
   {
     isSecurityState("broken", "insecure <img> load breaks security");
     finish();
   }
 
   function afterNavigationTest()

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecurePictureDup.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecurePictureDup.html
@@ -2,17 +2,18 @@
 <html>
 <head>
   <title>Unsecure img load in two windows</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
-    
+  /* import-globals-from mixedContentTest.js */
+
   openTwoWindows = true;
   testPage = "unsecurePictureDup.html";
 
   </script>
 </head>
 
 <body>
 </body>

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecurePictureInIframe.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecurePictureInIframe.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("broken", "insecure <img> in an <iframe> load breaks security");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureRedirect.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/test_unsecureRedirect.html
@@ -6,16 +6,17 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
+  /* import-globals-from mixedContentTest.js */
 
   hasMixedActiveContent = true;
 
   function runTest()
   {
     isSecurityState("broken", "insecure <img> load breaks security");
     finish();
   }

--- a/security/manager/ssl/tests/mochitest/mixedcontent/unsecurePictureDup.html
+++ b/security/manager/ssl/tests/mochitest/mixedcontent/unsecurePictureDup.html
@@ -6,17 +6,18 @@
   <script type="text/javascript" src="/MochiKit/DOM.js"></script>
   <script type="text/javascript" src="/MochiKit/Style.js"></script>
   <script type="text/javascript" src="/MochiKit/Signal.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="mixedContentTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 
   <script class="testbody" type="text/javascript">
-    
+  /* import-globals-from mixedContentTest.js */
+
   function runTest()
   {
     isSecurityState("broken", "insecure <img> load breaks security");
     finish();
   }
 
   function afterNavigationTest()
   {

new file mode 100644
--- /dev/null
+++ b/security/manager/ssl/tests/mochitest/stricttransportsecurity/.eslintrc.json
@@ -0,0 +1,7 @@
+{
+  // mochitest-chrome tests also exist in this directory, but don't appear to
+  // use anything not also available to plain mochitests. Since plain mochitests
+  // are the majority, we take the safer option and only extend the
+  // mochitest-plain eslintrc file.
+  "extends": "../../../../../../testing/mochitest/mochitest.eslintrc"
+}

--- a/security/manager/ssl/tests/mochitest/stricttransportsecurity/nosts_bootstrap.html
+++ b/security/manager/ssl/tests/mochitest/stricttransportsecurity/nosts_bootstrap.html
@@ -2,20 +2,21 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
 <!DOCTYPE HTML>
 <html>
   <head>
     <title>STS test iframe</title>
     <script>
-      var self = window;
+      let windowRef = window;
       window.addEventListener("load", function() {
-          self.parent.postMessage("BOOTSTRAP plain", "http://mochi.test:8888");
-        }, false);
+        windowRef.parent.postMessage("BOOTSTRAP plain",
+                                     "http://mochi.test:8888");
+      }, false);
     </script>
   </head>
   <body>
     <!-- This frame should be loaded over HTTPS to set the STS header. -->
     This frame was loaded using 
     <script>
       document.write(document.location.protocol);
     </script>

--- a/security/manager/ssl/tests/mochitest/stricttransportsecurity/plain_bootstrap.html
+++ b/security/manager/ssl/tests/mochitest/stricttransportsecurity/plain_bootstrap.html
@@ -2,20 +2,21 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
 <!DOCTYPE HTML>
 <html>
   <head>
     <title>STS test iframe</title>
     <script>
-      var self = window;
+      let windowRef = window;
       window.addEventListener("load", function() {
-          self.parent.postMessage("BOOTSTRAP plain", "http://mochi.test:8888");
-        }, false);
+        windowRef.parent.postMessage("BOOTSTRAP plain",
+                                     "http://mochi.test:8888");
+      }, false);
     </script>
   </head>
   <body>
     <!-- This frame should be loaded over HTTPS to set the STS header. -->
     This frame was loaded using 
     <script>
       document.write(document.location.protocol);
     </script>

--- a/security/manager/ssl/tests/mochitest/stricttransportsecurity/subdom_bootstrap.html
+++ b/security/manager/ssl/tests/mochitest/stricttransportsecurity/subdom_bootstrap.html
@@ -2,20 +2,21 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
 <!DOCTYPE HTML>
 <html>
   <head>
     <title>STS test iframe</title>
     <script>
-      var self = window;
+      let windowRef = window;
       window.addEventListener("load", function() {
-          self.parent.postMessage("BOOTSTRAP subdom", "http://mochi.test:8888");
-        }, false);
+        windowRef.parent.postMessage("BOOTSTRAP subdom",
+                                     "http://mochi.test:8888");
+      }, false);
     </script>
   </head>
   <body>
     <!-- This frame should be loaded over HTTPS to set the STS header. -->
     This frame was loaded using 
     <script>
       document.write(document.location.protocol);
     </script>

new file mode 100644
--- /dev/null
+++ b/security/manager/ssl/tests/unit/.eslintrc.json
@@ -0,0 +1,3 @@
+{
+  "extends": "../../../../../testing/xpcshell/xpcshell.eslintrc"
+}

--- a/security/manager/ssl/tests/unit/sss_readstate_child_worker.js
+++ b/security/manager/ssl/tests/unit/sss_readstate_child_worker.js
@@ -1,8 +1,10 @@
+/* import-globals-from head_psm.js */
+
 function run_test() {
   var SSService = Cc["@mozilla.org/ssservice;1"]
                     .getService(Ci.nsISiteSecurityService);
 
   ok(!SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
                              "expired.example.com", 0));
   ok(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
                             "notexpired.example.com", 0));

--- a/security/manager/ssl/tests/unit/test_cert_blocklist.js
+++ b/security/manager/ssl/tests/unit/test_cert_blocklist.js
@@ -12,16 +12,17 @@
 //   unmodified
 
 // First, we need to setup appInfo for the blocklist service to work
 var id = "xpcshell@tests.mozilla.org";
 var appName = "XPCShell";
 var version = "1";
 var platformVersion = "1.9.2";
 Cu.import("resource://testing-common/AppInfo.jsm", this);
+/*global updateAppInfo:false*/ // Imported via AppInfo.jsm.
 updateAppInfo({
   name: appName,
   ID: id,
   version: version,
   platformVersion: platformVersion ? platformVersion : "1.0",
   crashReporter: true,
 });
 

--- a/security/manager/ssl/tests/unit/test_hash_algorithms.js
+++ b/security/manager/ssl/tests/unit/test_hash_algorithms.js
@@ -72,17 +72,17 @@ function doHashStream(algo, value, cmp) 
   var stream = converter.convertToInputStream(value);
   hash.updateFromStream(stream, stream.available());
   hash = hexdigest(hash.finish(false));
   equal(hash, cmp,
         `Actual and expected hash for ${algo} should match updating from stream`);
 }
 
 function run_test() {
-  for (algo in hashes) {
+  for (let algo in hashes) {
     hashes[algo].forEach(
       function(e, i) {
         doHash(algo, messages[i], e);
 
         if (messages[i].length) {
           // this test doesn't work for empty string/stream
           doHashStream(algo, messages[i], e);
         }

--- a/security/manager/ssl/tests/unit/test_toolkit_securityreporter.js
+++ b/security/manager/ssl/tests/unit/test_toolkit_securityreporter.js
@@ -13,16 +13,17 @@
  * aboutCertError.xhtml once these make use of this component.
  */
 
 "use strict";
 const CC = Components.Constructor;
 const Cm = Components.manager;
 
 Cu.import("resource://testing-common/AppInfo.jsm");
+/*global updateAppInfo:false*/ // Imported via AppInfo.jsm.
 updateAppInfo();
 
 // We must get the profile before performing operations on the cert db.
 do_get_profile();
 
 const certdb = Cc["@mozilla.org/security/x509certdb;1"]
                  .getService(Ci.nsIX509CertDB);
 const reporter = Cc["@mozilla.org/securityreporter;1"]

new file mode 100644
--- /dev/null
+++ b/security/manager/tools/.eslintrc.json
@@ -0,0 +1,7 @@
+{
+  "globals": {
+    // JS files in this folder are commonly xpcshell scripts where |arguments|
+    // is defined in the global scope.
+    "arguments": false
+  }
+}

--- a/security/manager/tools/genRootCAHashes.js
+++ b/security/manager/tools/genRootCAHashes.js
@@ -16,17 +16,17 @@ var Cu = Components.utils;
 var Cr = Components.results;
 
 const nsX509CertDB = "@mozilla.org/security/x509certdb;1";
 const CertDb = Components.classes[nsX509CertDB].getService(Ci.nsIX509CertDB);
 
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/FileUtils.jsm");
 Cu.import("resource://gre/modules/NetUtil.jsm");
-Cu.import("resource://services-common/utils.js");
+const { CommonUtils } = Cu.import("resource://services-common/utils.js", {});
 
 const FILENAME_OUTPUT = "RootHashes.inc";
 const FILENAME_TRUST_ANCHORS = "KnownRootHashes.json";
 const ROOT_NOT_ASSIGNED = -1;
 
 const JSON_HEADER = "// This Source Code Form is subject to the terms of the Mozilla Public\n" +
 "// License, v. 2.0. If a copy of the MPL was not distributed with this\n" +
 "// file, You can obtain one at http://mozilla.org/MPL/2.0/. */\n" +

--- a/testing/xpcshell/xpcshell.eslintrc
+++ b/testing/xpcshell/xpcshell.eslintrc
@@ -25,22 +25,28 @@
     "do_print": false,
     "do_register_cleanup": false,
     "do_report_unexpected_exception": false,
     "do_test_finished": false,
     "do_test_pending": false,
     "do_throw": false,
     "do_timeout": false,
     "equal": false,
+    "greater": false,
+    "greaterOrEqual": false,
+    "less": false,
+    "lessOrEqual": false,
     "load": false,
     "mozinfo": false,
     "notDeepEqual": false,
     "notEqual": false,
     "notStrictEqual": false,
     "ok": false,
     "run_next_test": false,
     "run_test": false,
+    "run_test_in_child": false,
     "strictEqual": false,
+    "throws": false,
     "todo": false,
     "todo_check_false": false,
     "todo_check_true": false,
   }
 }