1147536 - Enable mozBrowser for desktop app runtime

Status: RESOLVED WONTFIX

(Firefox Graveyard :: Webapp Runtime, defect)

Description

[:Harald Kirschner :digitarald]

Several apps use it to wrap their site in a packaged app. Developers expect it to work cross-platform.

Comment 1

[Bill Walker [:bwalker] [@wfwalker]]

Hi Kan-Ru,

Can you give us any idea about what it would take to allow the mozBrowser permission for a privileged open web app runnning on desktop Firefox?

thanks,
-Bill

Comment 2

[Kan-Ru Chen [:kanru] (UTC+9)]

(In reply to Bill Walker [:bwalker] [@wfwalker] from comment #1)
> Hi Kan-Ru,
> 
> Can you give us any idea about what it would take to allow the mozBrowser
> permission for a privileged open web app runnning on desktop Firefox?
> 
> thanks,
> -Bill

While I'm not sure what you mean |privileged open web app running on desktop Firefox|, there is a single pref dom.mozBrowserFramesEnabled to control the exposure of this feature. If you are going to do that, we should carefully analyze the risk of exposing this to wider audience.

Comment 3

[Bill Walker [:bwalker] [@wfwalker]]

(In reply to Kan-Ru Chen [:kanru] from comment #2)
> (In reply to Bill Walker [:bwalker] [@wfwalker] from comment #1)
> > Hi Kan-Ru,
> > 
> > Can you give us any idea about what it would take to allow the mozBrowser
> > permission for a privileged open web app runnning on desktop Firefox?
> > 
> > thanks,
> > -Bill
> 
> While I'm not sure what you mean |privileged open web app running on desktop
> Firefox|, there is a single pref dom.mozBrowserFramesEnabled to control the
> exposure of this feature. If you are going to do that, we should carefully
> analyze the risk of exposing this to wider audience.

Hi Kan-Ru,

Here's what I mean: On a Firefox OS phone, I can create an app whose app manifest requests the "browser" permission. We install that app from Firefox Marketplace by calling mozApps.installPackage(). Upon launch, if that app is properly signed, it can use iframes with the browser attribute, as described at 

https://developer.mozilla.org/en-US/docs/Web/API/Using_the_Browser_API

I'd like to be able to do the exact same thing on Firefox for Windows or Mac OS X. I've got the same mozApps.installPackage() API present there, but currently browser frames don't work.

It sounds like all I'd need to do is enable that pref and work through the security implications?

thanks,
-Bill

Comment 4

[Kan-Ru Chen [:kanru] (UTC+9)]

(In reply to Bill Walker [:bwalker] [@wfwalker] from comment #3)
> (In reply to Kan-Ru Chen [:kanru] from comment #2)
> > (In reply to Bill Walker [:bwalker] [@wfwalker] from comment #1)
> > > Hi Kan-Ru,
> > > 
> > > Can you give us any idea about what it would take to allow the mozBrowser
> > > permission for a privileged open web app runnning on desktop Firefox?
> > > 
> > > thanks,
> > > -Bill
> > 
> > While I'm not sure what you mean |privileged open web app running on desktop
> > Firefox|, there is a single pref dom.mozBrowserFramesEnabled to control the
> > exposure of this feature. If you are going to do that, we should carefully
> > analyze the risk of exposing this to wider audience.
> 
> Hi Kan-Ru,
> 
> Here's what I mean: On a Firefox OS phone, I can create an app whose app
> manifest requests the "browser" permission. We install that app from Firefox
> Marketplace by calling mozApps.installPackage(). Upon launch, if that app is
> properly signed, it can use iframes with the browser attribute, as described
> at 
> 
> https://developer.mozilla.org/en-US/docs/Web/API/Using_the_Browser_API
> 
> I'd like to be able to do the exact same thing on Firefox for Windows or Mac
> OS X. I've got the same mozApps.installPackage() API present there, but
> currently browser frames don't work.

I see, thanks for the explanation.

> It sounds like all I'd need to do is enable that pref and work through the
> security implications?

Correct. And I think this should follow the "Intent to ship" process. https://wiki.mozilla.org/WebAPI/ExposureGuidelines

Comment 5

[Bill Walker [:bwalker] [@wfwalker]]

The current list of apps in Firefox Marketplace that use this permission:

https://thecount.paas.allizom.org/#/listing/permission/browser

Comment 6

[Myk Melez [:myk] [@mykmelez]]

Per bug 1238079, we're going to disable the desktop web runtime and remove it from the codebase, so we won't fix these bugs in it.