793747 - When installing an app, show the origin of the app in the confirmation prompt

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: Web Apps (PWAs), defect, P1)

Description

[Jason Smith [:jsmith]]

Right now when you try to install a web application, we just show up a simple pop-up to confirm installing the application. For security reasons, we should provide a bit more context of where the app is being installed from (i.e. the origin), as that establishes more trust to the user that they know what they are installing. We have implemented this support for desktop and ff os, so we might want to do the same for Android.

Comment 1

[Jason Smith [:jsmith]]

Might be worth tracking - the origin is important to show when installing an app as it gives the user context to where the app is being installed from. It also establishes parity with desktop and b2g.

Comment 2

[Jason Smith [:jsmith]]

Per talking in the sec-review for b2g app updates, the b2g equivalent was claimed to be a sec-want, especially for packaged app installs. I'm adding the keyword here for the same reason. And also noming for tracking given that security wants this as a safety measure.

Comment 3

[Jason Smith [:jsmith]]

(In reply to Jason Smith [:jsmith] from comment #2)
> Per talking in the sec-review for b2g app updates, the b2g equivalent was
> claimed to be a sec-want, especially for packaged app installs. I'm adding
> the keyword here for the same reason. And also noming for tracking given
> that security wants this as a safety measure.

See bug 827562 for context.

Comment 4

[Erin Lancaster [:elan]]

Triage comment: this is for hosted apps to start with.

Comment 5

[Erin Lancaster [:elan]]

Traige comment redux: we should likely have the same behavior for hosted and for packaged, the difference should be transparent to the user.

Comment 6

[Jason Smith [:jsmith]]

(In reply to Erin Lancaster [:elancaster] from comment #5)
> Traige comment redux: we should likely have the same behavior for hosted and
> for packaged, the difference should be transparent to the user.

No, this is definitely what you should not do with packaged apps. A packaged app has no concept of an app origin - it derives itself from an app:// URL. In the case of a packaged app, you should indicate the trusted store that the app is being installed from.

Comment 7

[Martyn Haigh (:mhaigh)]

Attachment: Adding app origin to install dialog

Added app origin to install dialog

Comment 8

[Jason Smith [:jsmith]]

Comment on attachment 735316 [details] [diff] [review]
Adding app origin to install dialog

Review of attachment 735316 [details] [diff] [review]:
-----------------------------------------------------------------

::: mobile/android/chrome/content/browser.js
@@ +6023,5 @@
>      let manifest = new ManifestHelper(jsonManifest, aData.app.origin);
>      let name = manifest.name ? manifest.name : manifest.fullLaunchPath();
>      let showPrompt = true;
>  
> +    if (!showPrompt || Services.prompt.confirm(null, Strings.browser.GetStringFromName("webapps.installTitle"), name + "\n" + aData.app.origin)) {

A packaged app doesn't have a concept of an origin. So what happens here if I try install a packaged app? What do I end up seeing in the install prompt?

Comment 9

[Martyn Haigh (:mhaigh)]

Attachment: Screenshot showing install prompt with domain URL

A packaged app will show the base URL of the domain from which the app is being installed.

Comment 10

[Jason Smith [:jsmith]]

(In reply to Martyn Haigh (:mhaigh) from comment #9)
> Created attachment 735336 [details]
> Screenshot showing install prompt with domain URL
> 
> A packaged app will show the base URL of the domain from which the app is
> being installed.

Ah okay. Looks good then for the packaged app side. Thanks for checking.

Comment 11

[Mark Finkle (:mfinkle) (use needinfo?)]

Comment on attachment 735316 [details] [diff] [review]
Adding app origin to install dialog

Looks good.

Comment 12

[Martyn Haigh (:mhaigh)]

checkin-needed

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/783f66376d65

Comment 14

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/783f66376d65