Closed Bug 970044 Opened 10 years ago Closed 10 years ago

Figure out where we want to expose navigator.mozKeyboard

Categories

(Core :: DOM: Core & HTML, defect)

x86
macOS
defect
Not set
normal

Tracking

()

RESOLVED WONTFIX

People

(Reporter: ehsan.akhgari, Unassigned)

References

Details

This API should definitely not be visible to Web content anywhere (desktop/Android/Firefox OS).  We currently use a JavaScript-navigator-property manifest entry to expose this on navigator unconditionally, and we need to switch that to do the proper checks.  Is this API supposed to be enabled for apps with a specific permission?
(The check in MozKeyboard.init seems to suggest that this should be hidden based on the "input-manage" permission, but we may want to enable it based on a pref if needed too.)
(In reply to :Ehsan Akhgari (needinfo? me!) (slow responsiveness, emailacopolypse) from comment #0)
> This API should definitely not be visible to Web content anywhere
> (desktop/Android/Firefox OS).  We currently use a
> JavaScript-navigator-property manifest entry to expose this on navigator
> unconditionally, and we need to switch that to do the proper checks.  Is
> this API supposed to be enabled for apps with a specific permission?

Yes, mozKeyboard API should be only enabled for certified app with the "input-manage" permission.
(In reply to :Ehsan Akhgari (needinfo? me!) (slow responsiveness, emailacopolypse) from comment #1)
> (The check in MozKeyboard.init seems to suggest that this should be hidden
> based on the "input-manage" permission, but we may want to enable it based
> on a pref if needed too.)
Currently navigator.mozKeyboard will be disabled if there is no "input-manage" permission and we need a pref, such as 
"dom.mozKeyboard.enabled" to hide it on desktop and android. 

mozKeyboard API should be only exposed to the certified app with the "input-manage" permission.
navigator.mozKeyboard has been deprecated. We should remove it, it's just that we have some parts not transferred to mozInputMethod yet that are needed in system.
So are we going to either remove this API or at least get rid of the dump()?

I was concerned to see this in my console in a current FF30 beta:

  No permission to use the keyboard API for http://googleads.g.doubleclick.net

And tracked down this bug (and bug 969897, and bug 838308) to figure out what the heck was going on.
And I'm not the only one, it showed up in Google's search suggestions because there are a ton of hits:

https://www.google.com/?gws_rd=ssl#q=no+permission+to+use+the+keyboard+api+for+http+%2F%2Fgoogleads.g.doubleclick.net
mozKeyboard has been removed by bug 986992 in FF31.
Status: NEW → RESOLVED
Closed: 10 years ago
Depends on: 986992
Resolution: --- → FIXED
Resolution: FIXED → WONTFIX
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.