1110074 - [BrowserAPI] Change "browser" permission to certified apps only

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Kan-Ru Chen [:kanru] (UTC+9)]

As discussed in mozlandia we both think it's a mistake to allow privileged app to use browser-api. We should change it to certified only, or restrict a subset to certified only.

Comment 1

[Marco Castelluccio [:marco]]

We're using this API in our app: https://github.com/andreasgal/j2me.js

Comment 2

[[:fabrice] Fabrice Desré]

I chatted a bit with Paul about that. While not ideal, he believes we are not at risk of permission leakage because of csp and origin checks. So hold on for now.

Comment 3

[Ben Francis [:benfrancis]]

I think getScreenshot() is probably the most privileged bit of the Browser API?

Comment 4

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.