1217267 - Remember my choice is available for hosted permissions (once you choose, no way to change permission)

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::System::System UI, defect, P1)

Description

[Paul Theriault [:pauljt] (no longer reading bugmail)]

I just noticed that remember my choice is enabled for geolocation, even for websites. Once the user makes a choice, the choice is persisted forever.The only way to clear it is to "clear cookies and cache" in the settings->browser privacy.

This means:
- a user that chooses "deny" always, that website will never be able to use geolocation again.
- if you accept always for a http site, any MITM attacker can now access geolocation without a prompt

This affect desktop-notifications permission too, and my guess is that it will be all web permissions, except for the getUserMedia ones, since they have a special prompt.

[Blocking Requested - why for this release]:
For the reasons highlighted above I think this needs to block. Breaks web functionality and user security.

Comment 1

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Agree we should block as P1 -- should not be a hard fix but there is too many nested |if| blocks unfortunately.

FYI we already got https://github.com/mozilla-b2g/gaia/blob/master/apps/system/js/permission_manager.js#L384-L389

Comment 2

[Gregor Wagner [:gwagner]]

Is this a regression?

Comment 3

[Julien Wajsberg [:julienw]]

I can try to get a quick look and see if I can fix it to relieve the System team's load :)

Comment 4

[Julien Wajsberg [:julienw]]

Testcase: https://everlong.org/mozilla/test-permission/

Comment 5

[Julien Wajsberg [:julienw]]

Note that contrary to Desktop, the user choice is kept for some time even if the user doesn't check "remember my choice". But rebooting makes the choice appear again, if the user didn't check the "remember my choice" checkbox.

If I check the "remember my choice" then the choice is kept accross reboots. I couldn't find a way to remove the permission. I tried on 1.3 and it seems we had the same issue at that time already, so I don't think it's a regression.

Comment 6

[GitHub Autolander Bot]

Attachment: [gaia] julienw:1217267-permission-websites > mozilla-b2g:master

Comment 7

[Julien Wajsberg [:julienw]]

Comment on attachment 8678124 [details] [review]
[gaia] julienw:1217267-permission-websites > mozilla-b2g:master

hey Tim,

what do you think ?

I thought this could make a difference for fullscreen permission requests from apps... but actually there is no permission requests from apps :) So I think we're good.

I filed bug 1217852 to bring the feature back in a consistent way -- Stéphanie told me it should be part of the new security model anyway.

Comment 8

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Comment on attachment 8678124 [details] [review]
[gaia] julienw:1217267-permission-websites > mozilla-b2g:master

The actual boolean is send back here:

https://github.com/julienw/gaia/blob/1217267-permission-websites/apps/system/js/permission_manager.js#L397-L403

There is just too many statements flipping here and there in this file, so I assume you have made the right effort to ensure we send the remember bit back when we show the UI, and we don't otherwise.

IMHO whether or not to allow to user to remember this security decision should be something given in Gecko. Gaia System is just the UI here. Do we know the where reverent Firefox Desktop/Mobile code is and whether or not Gecko could expose that instead?

Comment 9

[Julien Wajsberg [:julienw]]

(In reply to Tim Guan-tin Chien [:timdream] (please needinfo) from comment #8)
> Comment on attachment 8678124 [details] [review]
> [gaia] julienw:1217267-permission-websites > mozilla-b2g:master
> 
> The actual boolean is send back here:
> 
> https://github.com/julienw/gaia/blob/1217267-permission-websites/apps/system/
> js/permission_manager.js#L397-L403

yeah; we already have a "!detail.isApp" here so I think it's set to "false" initially in the case we're interested in here.

> 
> There is just too many statements flipping here and there in this file, so I
> assume you have made the right effort to ensure we send the remember bit
> back when we show the UI, and we don't otherwise.

When this comes from web apps, with the patch we just don't show the "remember" UI at all when this comes from web content or pinned web content.

I also checked that after installing the app we still get the "remember" UI and that it works.

> 
> IMHO whether or not to allow to user to remember this security decision
> should be something given in Gecko. Gaia System is just the UI here. Do we
> know the where reverent Firefox Desktop/Mobile code is and whether or not
> Gecko could expose that instead?

I suspect this discussion should be part of the new security model talk. Please raise your concerns in bug 1217852.

Comment 10

[Julien Wajsberg [:julienw]]

master: https://github.com/mozilla-b2g/gaia/commit/c5771bbdfea430abd867d286d9f22b7d7ea8af62

Thanks for the review!