1315325 - Add telemetry to measure use of NPAPI NPN Get/Post URL apis

Status: RESOLVED WONTFIX

(Core Graveyard :: Plug-ins, defect)

Description

[Jim Mathies [:jimm]]

See bug 1202910 for some background. The sandboxing team is interesting in knowing how often these apis are used.

Comment 1

[David Parks [:handyman]]

Attachment: Telemetry for PLUGIN_NPN_GETURL_COUNT and PLUGIN_NPN_POSTURL_DATA

Looks to me from reading bug 1202910 like we only care about the difference between POST data sources (file vs. memory) -- we don't care e.g. about whether the user gave a notify callback.  So this is basic.

FYI, toolkit.telemetry.enabled is not set (for me, anyway) in new profiles.

A simple way to test the samples is by going to http://www.tinywebgallery.com/en/tfu/web_demo2.php, clicking "Add File" and choosing a small image from your local drive to upload, and then clicking "Upload".  When uploading a file, the plugin calls PostURL, then GetURL, so each stat should increase by 1 with an upload.  The plugin also calls GetURL on some kind of (infrequent) timer so the counts are only temporarily as expected. 

-----

Tests:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=fec35a341713cf75ed0e506f183e27517710f494

Comment 2

[Jim Mathies [:jimm]]

Comment on attachment 8815955 [details] [diff] [review]
Telemetry for PLUGIN_NPN_GETURL_COUNT and PLUGIN_NPN_POSTURL_DATA

Review of attachment 8815955 [details] [diff] [review]:
-----------------------------------------------------------------

::: toolkit/components/telemetry/Histograms.json
@@ +3650,5 @@
> +    "bug_numbers": [1315325],
> +    "alert_emails": ["[e-mail]"],
> +    "expires_in_version": "56",
> +    "kind": "enumerated",
> +    "n_values": 5,

do we need 5 here, couldn't this be 2?

Comment 3

[Benjamin Smedberg]

I'm a bit confused about why we need to use telemetry to answer any questions here. There is only one plugin (Flash), and we have good contacts with the Flash developers.

We already know that Flash calls geturl all the time (it's used to fetch basically everything in the plugin). So counting how much it calls doesn't seem all that interesting.

If you're interested specifically in whether posturl only ever uses memory for Flash, or whether it sometimes uses a file, that I don't know offhand but we should be able to get that from Adobe more quickly and reliably than from telemetry.

Comment 4

[Benjamin Smedberg]

Or if the question about getURL is specifically about the ASFILE variants, I don't *think* Flash uses those but we should check. They were used primarily by Acrobat IIRC.

Comment 5

[Jim Mathies [:jimm]]

(In reply to Benjamin Smedberg [:bsmedberg] from comment #3)
> If you're interested specifically in whether posturl only ever uses memory
> for Flash, or whether it sometimes uses a file, that I don't know offhand
> but we should be able to get that from Adobe more quickly and reliably than
> from telemetry.

Hey Benjamin, we're interested in knowing -

1) how often the post and get apis are used (sounds like get is quite common with flash)
2) how often the post api uses a file path vs. a memory buffer

If we can ask adobe for this great, they have stats on api usage like this? #2 is what we're most interested in. Telemetry felt like a good fit for this.

Comment 6

[Benjamin Smedberg]

I assumed you wanted to know this to see if you could stop supporting some code paths (such as the ASFILE version of get, and the file version of post). What's the ultimate problem to solve here?

Re #1: I very much doubt anyone has stats on how *often* these APIs are called. So maybe I don't understand what's you're optimizing.
Re #2: *if* Flash uses the path API at all, I doubt we'll have stats on how often. But I bet they don't use it at all.

Comment 7

[Jim Mathies [:jimm]]

(In reply to Benjamin Smedberg [:bsmedberg] from comment #6)
> I assumed you wanted to know this to see if you could stop supporting some
> code paths

Yes, that's the idea.

> (such as the ASFILE version of get, and the file version of
> post). What's the ultimate problem to solve here?

For clarification, what is the ASFILE version of the get apis you mention here? Are you referring to stream support with NPN_GetURLNotify?

https://developer.mozilla.org/en-US/Add-ons/Plugins/Reference/NPN_GetURL
https://developer.mozilla.org/en-US/Add-ons/Plugins/Reference/NPN_GetURLNotify


> Re #1: I very much doubt anyone has stats on how *often* these APIs are
> called. So maybe I don't understand what's you're optimizing.
> Re #2: *if* Flash uses the path API at all, I doubt we'll have stats on how
> often. But I bet they don't use it at all.

Use of the file version of NPN_PostURL seemed the most interesting. If there's a simple way to access that through flash, pick a known local path to a file in the profile or someplace else, and push it to a remote server without any prompting for the user. File access restrictions would help here, but we were curious if this is being used at all such that if it isn't we could just deprecate it for security purposes.

Comment 8

[Benjamin Smedberg]

(In reply to Jim Mathies [:jimm] from comment #7)
> (In reply to Benjamin Smedberg [:bsmedberg] from comment #6)
> > I assumed you wanted to know this to see if you could stop supporting some
> > code paths
> 
> Yes, that's the idea.

Then I'm confident that telemetry is not the way to answer these questions.

> For clarification, what is the ASFILE version of the get apis you mention
> here? Are you referring to stream support with NPN_GetURLNotify?

I'm referring to the stype parameter of NPP_NewStream, which is triggered not only by NPN_GetURLNotify and NPN_PostURLNotify but also by the initial object src= loading. The plugin is allowed to ask for NP_NORMAL/NP_ASFILEONLY/NP_ASFILE/NP_SEEK. See https://developer.mozilla.org/en-US/Add-ons/Plugins/Reference/NPP_NewStream

> Use of the file version of NPN_PostURL seemed the most interesting. If
> there's a simple way to access that through flash, pick a known local path
> to a file in the profile or someplace else, and push it to a remote server
> without any prompting for the user. File access restrictions would help
> here, but we were curious if this is being used at all such that if it isn't
> we could just deprecate it for security purposes.

I don't think this is used the way you think it's used, but you really need to ask Adobe. I believe that the purpose of constructing a file for NPN_PostURL is so if the post is large (megabtyes or gigabytes), the plugin can construct the file through streaming and doesn't have to keep it all in memory. I very much doubt that this would be anything except a temporary file created specifically to construct an HTTP post.

However, I don't know whether Flash uses this at all, and if it does whether it uses the normal temp directory or something else.

Comment 9

[Benjamin Smedberg]

Adobe confirmed that they don't use files and we've removed that API surface, so we don't need telemetry.