1116713 - Add [AvailableIn="CertifiedApps"] and [CheckPermissions="mobileconnection"] to MobileConnection API

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: RIL, defect)

Description

[Hsin-Yi Tsai (she/her) [:hsinyi]]

We need to do this for MozMobileCellInfo.webidl, MozMobileConnectionArray.webidl, MozMobileConnectionInfo.webidl, MozMobileConnection.webidl, MozMobileNetworkInfo.webidl

Comment 1

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Hsin-Yi Tsai [:hsinyi] from comment #0)
> We need to do this for MozMobileCellInfo.webidl,
> MozMobileConnectionArray.webidl, MozMobileConnectionInfo.webidl,
> MozMobileConnection.webidl, MozMobileNetworkInfo.webidl

Also,
MozClirModeEvent.webidl
MozEmergencyCbModeEvent.webidl
MozOtaStatusEvent.webidl

Comment 2

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Attachment: WIP

mobileConnection.lastKnownNetwork and mobileConnection.lastKnownHomeNetwork are available to privileged apps, which need special care.

Comment 3

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Attachment: WIP (v2)

MobileConnectionArray and MobileConnection API should be exposed to privileged apps because mobileconnection.lastKnownNetwork and mobileconnection.lastKnownHomeNetwork are for 3rd party apps with mobilenetwork persmission.

The revision does:
1) correct the permission hook in WIP
2) modify related mochitests, mainly by adding a pref |dom.ignore_webidl_scope_checks| to ignore webidl scope checks

Comment 4

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Comment on attachment 8558965 [details] [diff] [review]
WIP (v2)

Review of attachment 8558965 [details] [diff] [review]:
-----------------------------------------------------------------

Hi Olli,

Most MobileConnection interfaces are for certified apps only, except mobileConnection.lastKnownNetwork and mobileConnection.lastKonowHomeNetwork, which are exposed to privileged apps with mobilenetwork permission.
This patch is to make the webapi more descriptive.

Could you help review? Thank you.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 8558965 [details] [diff] [review]
WIP (v2)

Don't we need to make permission checks in the code dispatching the
events stricter too?
I mean cases like http://mxr.mozilla.org/mozilla-central/source/dom/mobileconnection/MobileConnection.cpp?rev=8f1c3e86aa20#1072

MozMobileConnection is exposed to Privileged apps, and it is
EventTarget, so even if we remove those onfoo properties from Privileged apps,
addEventListener would still work.


Please re-ask review if I missed something which already prevents us
dispatching events to privileged apps.

Comment 6

[Hsin-Yi Tsai (she/her) [:hsinyi]]

(In reply to Olli Pettay [:smaug] (review overload. No more review requests before Feb 8, please) from comment #5)
> Comment on attachment 8558965 [details] [diff] [review]
> WIP (v2)
> 
> Don't we need to make permission checks in the code dispatching the
> events stricter too?
> I mean cases like
> http://mxr.mozilla.org/mozilla-central/source/dom/mobileconnection/
> MobileConnection.cpp?rev=8f1c3e86aa20#1072
> 
> MozMobileConnection is exposed to Privileged apps, and it is
> EventTarget, so even if we remove those onfoo properties from Privileged
> apps,
> addEventListener would still work.
> 
> 
> Please re-ask review if I missed something which already prevents us
> dispatching events to privileged apps.

Your concern is valid and I agree we should do that. I will address your comments in a revision, thank you Olli!

Comment 7

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Sorry that I switch to other stuff.

Comment 8

[BMO Automation]

Firefox OS is not being worked on