Ensure exposed objects are immutable to prevent abuse by others

RESOLVED FIXED in Firefox 34

Status

defect
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: mikedeboer, Assigned: mikedeboer)

Tracking

unspecified
mozilla34
Points:
1
Bug Flags:
firefox-backlog +
qe-verify -

Firefox Tracking Flags

(firefox34 fixed)

Details

Attachments

(2 attachments, 1 obsolete attachment)

ATM the objects exposed by Loop JSMs and through the navigator.mozLoop interface are mutable.
We don't want any 3rd party to modify or augment the existing objects, so let's guard against that.
Marco, can you add this to the current iteration?
Assignee: nobody → mdeboer
Status: NEW → ASSIGNED
Flags: needinfo?(mmucci)
Update to use `Object.seal` instead of `Object.freeze`, because we _do_ want setting existing properties to work.
Attachment #8456102 - Attachment is obsolete: true
Attachment #8456102 - Flags: review?(standard8)
Attachment #8456110 - Flags: review?(standard8)
Added to Iteration 33.3.  Mike, can you provide a point value and if the bug should be marked as [qa+] or [qa-] for verification.
Flags: needinfo?(mmucci)
Whiteboard: p=0 s=33.3 [qa?]
Whiteboard: p=0 s=33.3 [qa?] → p=1 s=33.3 [qa-]
Mike -- Standard8 just went on PTO for a week.  Can you ping Dolske for a review?  (If you need a Loop peer while Standard8 is away, Dmose and Niko are Loop peers.)
Flags: needinfo?(mdeboer)
Comment on attachment 8456110 [details] [diff] [review]
Patch v1.1: ensure exposed objects are immutable to prevent abuse by others

Justin, could you review this one for me? First time I ask you for a review! ;)
Attachment #8456110 - Flags: review?(standard8) → review?(dolske)
Flags: needinfo?(mdeboer)
Comment on attachment 8456110 [details] [diff] [review]
Patch v1.1: ensure exposed objects are immutable to prevent abuse by others

Review of attachment 8456110 [details] [diff] [review]:
-----------------------------------------------------------------

I assume the Loop folks are aware of this change? If so r+.
Attachment #8456110 - Flags: review?(dolske) → review+
Whiteboard: p=1 s=33.3 [qa-] → p=1 s=34.1 [qa-]
Flags: firefox-backlog+
Thanks Justin! I also discussed this patch with Standard8 (Loop peer).

Pushed to fx-team: https://hg.mozilla.org/integration/fx-team/rev/19ae3d5f6884
Iteration: --- → 34.1
Points: --- → 1
Whiteboard: p=1 s=34.1 [qa-] → [qa-]
Re-pushed to fx-team with test fixes: https://hg.mozilla.org/integration/fx-team/rev/7557b7137ac5
Rebased and test fixes. Carrying over r=dolske.
Attachment #8461077 - Flags: review+
https://hg.mozilla.org/mozilla-central/rev/7557b7137ac5
Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla34
Flags: qe-verify-
QA Contact: anthony.s.hughes
Whiteboard: [qa-]
You need to log in before you can comment on or make changes to this bug.