1038648 - Ensure exposed objects are immutable to prevent abuse by others

Status: RESOLVED FIXED

(Hello (Loop) :: Client, defect)

Description

[Mike de Boer [:mikedeboer]]

ATM the objects exposed by Loop JSMs and through the navigator.mozLoop interface are mutable.
We don't want any 3rd party to modify or augment the existing objects, so let's guard against that.

Comment 1

[Mike de Boer [:mikedeboer]]

Marco, can you add this to the current iteration?

Comment 2

[Mike de Boer [:mikedeboer]]

Attachment: Patch v1: ensure exposed objects are immutable to prevent abuse by others

Comment 3

[Mike de Boer [:mikedeboer]]

Attachment: Patch v1.1: ensure exposed objects are immutable to prevent abuse by others

Update to use `Object.seal` instead of `Object.freeze`, because we _do_ want setting existing properties to work.

Comment 4

[Marco Mucci [:MarcoM]]

Added to Iteration 33.3.  Mike, can you provide a point value and if the bug should be marked as [qa+] or [qa-] for verification.

Comment 5

[Maire Reavy [:mreavy]]

Mike -- Standard8 just went on PTO for a week.  Can you ping Dolske for a review?  (If you need a Loop peer while Standard8 is away, Dmose and Niko are Loop peers.)

Comment 6

[Mike de Boer [:mikedeboer]]

Comment on attachment 8456110 [details] [diff] [review]
Patch v1.1: ensure exposed objects are immutable to prevent abuse by others

Justin, could you review this one for me? First time I ask you for a review! ;)

Comment 7

[Justin Dolske [:Dolske]]

Comment on attachment 8456110 [details] [diff] [review]
Patch v1.1: ensure exposed objects are immutable to prevent abuse by others

Review of attachment 8456110 [details] [diff] [review]:
-----------------------------------------------------------------

I assume the Loop folks are aware of this change? If so r+.

Comment 8

[Mike de Boer [:mikedeboer]]

Thanks Justin! I also discussed this patch with Standard8 (Loop peer).

Pushed to fx-team: https://hg.mozilla.org/integration/fx-team/rev/19ae3d5f6884

Comment 9

[Ed Morley [:emorley]]

Backed out for failures in test_loopservice_initialize.js:
https://tbpl.mozilla.org/php/getParsedLog.php?id=44438273&tree=Fx-Team
https://tbpl.mozilla.org/php/getParsedLog.php?id=44437586&tree=Fx-Team


remote:   https://hg.mozilla.org/integration/fx-team/rev/42bb5d450124

Comment 10

[Mike de Boer [:mikedeboer]]

Yikes!

Try push with fix: https://tbpl.mozilla.org/?tree=Try&rev=595277b75a4a

Comment 11

[Mike de Boer [:mikedeboer]]

Re-pushed to fx-team with test fixes: https://hg.mozilla.org/integration/fx-team/rev/7557b7137ac5

Comment 12

[Mike de Boer [:mikedeboer]]

Attachment: Patch v1.2: ensure exposed objects are immutable to prevent abuse by others

Rebased and test fixes. Carrying over r=dolske.

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7557b7137ac5