983363 - Don't ship debug IAC rules into production

Status: RESOLVED INCOMPLETE

(Core :: DOM: Device Interfaces, defect)

Description

[Guilherme Gonçalves [:ggp]]

Find My Device uses the Inter-App Communication (IAC) API to receive fake commands from a test app. This is only necessary during tests.

The IAC API allows an app to establish rules specifying which other apps it wants to communicate with, by listing in its manifest.webapp the URLs of the manifests of the other apps it is interested in.

We currently have the following two rules in our manifest.webapp, in order to communicate with the test app:

          "app://test-findmydevice.gaiamobile.org/manifest.webapp",
          "http://test-findmydevice.gaiamobile.org:8080/manifest.webapp"

These URLs, however, could potentially be spoofed by a different app when the test app is not installed, which happens in production builds. Such app could then gain control over Find My Device. Thus, these rules should be removed from production builds.

See https://bugzilla.mozilla.org/show_bug.cgi?id=938901#c27 for a possible security flaw involving this.

Comment 1

[Guilherme Gonçalves [:ggp]]

Attachment: bug 983363 - remove IAC debug rules from find my device [checkin: comment 3]

Just noticed that the build system (specifically, build/webapp-manifests.js) is now smart enough to replace the rules in the manifest with the debugging ones if necessary. So we can just remove the hard-coded debug rules now.

Comment 2

[Vivien Nicolas (:vingtetun) (:21) - (NOT reading bugmails, needinfo? please)]

Let's also keep this bug opened once the first part of the patch lands since app:// can still be spoofed.

Comment 3

[Ryan VanderMeulen [:RyanVM]]

Master: https://github.com/mozilla-b2g/gaia/commit/badf2a6f6d4f4507ce45c0f56f573812fe8ae048

Comment 4

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Gene, could you look at this?

Comment 5

[Gene Lian (I already quit Mozilla)]

This one seems to be a Gaia bug. Anyway, although we allow app's manifest to define its own IAC rules, we haven't opened IAC to non-certified apps, which means even if the rules work, it only works for two certified apps to communicate with each other with limitations.

Comment 6

[Preeti Raghunath(:Preeti)]

Erin

User impact please?

Comment 7

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

It seems like this doesn't affect us shipping FMD since it is restricted to certified apps on. Correct Gene?

Comment 8

[Gene Lian (I already quit Mozilla)]

Yes! Correct! IAC doesn't work at all on the non-certified apps.

I don't know what else Gecko can support on this bug? Isn't this a pure Gaia bug? May we just close this bug since comment #1 lands? needinfo :gpp. Please correct me if I'm wrong. Thanks!

Btw, the way of specifying the manifestURLs in the manifest.webapp is going to be disabled under way (bug 1019493).

Comment 9

[Guilherme Gonçalves [:ggp]]

I think there are two possible courses of action for this bug, depending on whether bug 1019493 lands or not, as I can see people still have (justifiable) second thoughts about it.

If it lands, then it looks like we can just remove manifestURLs from FMD's manifest and be done with it. If it doesn't, then yes, this remains an issue, but it seems to me that it can be solved by making Gaia's build system smart enough to remove these rules as needed, so I don't think we need anything from Gecko.

I also agree that this isn't a major issue right now given that IAC only works for certified apps; however, if the outcome of bug 1019493 is that this restriction doesn't provide enough security, then of course we should follow suit and get this fixed on Gaia as soon as possible.

Comment 10

[Andrew Overholt [:overholt]]

Bug 1019493 comment 15 confirms we will never attempt to expose IAC to non-certified apps and the patches there seem likely to land.  Should we just let bug 1019493's resolution work for this bug, too, and drop the 2.0 blocker here?

Comment 11

[Guilherme Gonçalves [:ggp]]

I'm OK with that. Once bug 1019493 lands, we should be free to just remove the manifestURLs from our manifest, and I don't think we need to block on this anymore.

Comment 12

[Andrew Overholt [:overholt]]

Sounds good.  I'll remove the blocking flag here while we wait for bug 1019493 to be resolved.

Comment 13

[Kyle Machulis [:qdot] [:kmachulis] (INACTIVE)]

Cleaning up Device Interfaces component, and mass-marking old FxOS bugs as incomplete.

If any of these bugs are still valid, please let me know.

Comment 14

[Firefox Bug Husbandry Bot]

Removing leave-open keyword from resolved bugs, per :sylvestre.