1218998 - (newtab-web-apis) [Meta] Replace message communication to remote newtab by API's

Status: RESOLVED WONTFIX

(Firefox :: New Tab Page, defect)

Description

[Olivier Yiptong [:oyiptong]]

Messages will be replaced by Web API's.

These API's will allow us to decrease the amount of code used to prepare and send messages.

This also reduces our security surface.

We need to ensure that the Web API's are only injected for specific hostnames:
localhost and newtab.cdn.mozilla.net

Comment 1

[Olivier Yiptong [:oyiptong]]

Dan, does putting localhost in the whitelist for the web API present a big risk?

The data exposed will be the top 100 frecent sites for the profile.
The API will also enable the ability to generate screenshots for urls and allow writes to 2 boolean prefs to be flipped (2 states of enablement for the newtab page) and 1 list of pinned links.

We want to put localhost on a whitelist for development and test automation purposes

If this proves to be too sensitive, we can keep sending messages.

Comment 2

[Olivier Yiptong [:oyiptong]]

Marc, perhaps we can enable localhost conditionally, under a pref?
Would that work?

Comment 3

[Marc Schifer [mschifer]]

using prefs is fine from a test perspective, but any pref I can set via a test, could also be set via an add-on

Comment 4

[Olivier Yiptong [:oyiptong]]

I suppose if you can set that pref, you have enough privileges to do all the web API's offer.

However, if we don't hide the API behind a pref, pages that run on localhost would have more privileges than they did before.

Comment 5

[Daniel Veditz [:dveditz]]

I don't mind localhost behind a pref, but unhappy exposing it by default. I'm not worried about add-ons flipping the pref to re-expose it because a malicious add-on can do a lot worse.

Comment 6

[Olivier Yiptong [:oyiptong]]

Bobby, I saw your recommendations for RemotePageManager from bug 1221728.

What are your thoughts for an API to return promises?

Comment 8

[Olivier Yiptong [:oyiptong]]

Given we are taking on this bug now, let's also remove the code that won't be used anymore by messaging.

This includes:

* RemoteNewTabUtils.jsm
* Messages in RemoteAboutNewTab.jsm

and perhaps more.

Comment 9

[Bobby Holley (:bholley)]

(In reply to Olivier Yiptong [:oyiptong] from comment #6)
> Bobby, I saw your recommendations for RemotePageManager from bug 1221728.
> 
> What are your thoughts for an API to return promises?

If it's implemented with WebIDL, it should be fine. Boris has been doing a lot of work to improve promise support with WebIDL. Boris, do you have any specific suggestions of caveat for the about:newtab team? They want to expose special APIs to CDN content implementing about:newtab.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Shouldn't be a problem.  Just make sure Promise.jsm doesn't get involved in web content.

Comment 11

[Marcos Caceres [:marcosc]]

(In reply to Boris Zbarsky [:bz] from comment #10)
> Shouldn't be a problem.  Just make sure Promise.jsm doesn't get involved in
> web content.

Argh, Promise.jsm is evil. Hope we can kill that soon.

Comment 12

[Marcos Caceres [:marcosc]]

Seems that the remote about:newtab project is going to use WebChannel.jsm instead.