1361418 - Remove Java Addons support from Fennec

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, enhancement)

Description

[Nick Alexander :nalexander [he/him]]

Bug 794479 and later bugs like Bug 1168407 added support for add-ons to dynamically inject compiled Java classes (in the form of DEX files) into the Fennec process and pass messages between the injected Java code and the JavaScript code in the add-on.

This functionality was intended to grow into a robust API for add-ons to interact with the Android system.  This didn't happen: I'm not aware of a single consumer, although I haven't searched thoroughly.  (Certainly there has never been a bug report, a question about how to use the system, or a feature request for extensions.)  The only use case I know of was that I used the approach to build a proof of concept that integrated with a potential partner's Java safe-browsing API.

This ticket tracks removing this functionality entirely.  The Java Addon approach doesn't make sense in a Web Extensions-only world, where we want to dramatically reduce the API surface area that the browser needs to support.  And it doesn't make sense to invest in documenting and testing this feature.  It doesn't make sense to allow code injection as we continue to try to secure Fennec and keep browser crashes down.  It doesn't make sense to build features for potential partners in this way: we've had success modifying the in-tree code for partners.

Let's simplify our code base, reduce our attack surface, and cull an edge-case from the build system!

Comment 1

[Nick Alexander :nalexander [he/him]]

sebastian: as the technical owner of Fennec, do you agree with removing Java Addons from Fennec?

Comment 2

[Nick Alexander :nalexander [he/him]]

James, Barbara, Maria -- flagging product people in case there's some product use case I don't know about, past, present, or future.

Mike -- flagging you since this could be relevant to distributions.

Max -- flagging you since this would simplify the transition to the Gradle build system.

Comment 3

[Nick Alexander :nalexander [he/him]]

I think we'd WONTFIX Bug 799631 and any others we found as well.

Comment 4

[Mike Kaply [:mkaply]]

These APIs aren't used in distros.

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

(In reply to Nick Alexander :nalexander from comment #1)
> sebastian: as the technical owner of Fennec, do you agree with removing Java
> Addons from Fennec?

Yeah, I agree. We do not want to load arbitrary Java code and keeping this is counter-productive to the add-ons roadmap.

Comment 6

[Nick Alexander :nalexander [he/him]]

Attachment: Bug 1361418 - Remove Java Addons from Firefox for Android.

The Java Addons mechanism never got traction and is not Web Extensions
compatible.  Removing it simplifies the product and the build system.

Review commit: https://reviewboard.mozilla.org/r/135590/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/135590/

Comment 7

[James Cheng[:JamesCheng]]

Thanks for the ni, I agree and basically we're not dealing with Addons on Fennec so I have no concern about this.

Comment 8

[Sebastian Kaspari (:sebastian; :pocmo)]

Comment on attachment 8863855 [details]
Bug 1361418 - Remove Java Addons from Firefox for Android.

https://reviewboard.mozilla.org/r/135590/#review138812

Comment 9

[Nick Alexander :nalexander [he/him]]

Clearing NI from additional product folks.  Sorry for the noise, Barbara and Maria!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/801705332e54
Remove Java Addons from Firefox for Android. r=sebastian

Comment 11

[Nick Alexander :nalexander [he/him]]

I need an MDN administrator to remove https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API/JavaAddonManager.jsm.  I've already removed the link from https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API.

Since this API has never gained traction, I don't think we need to go to the effort of deprecating it on MDN.  (We're not doing that in the product itself.)

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/801705332e54

Comment 13

[Chris Mills [:cmills]]

(In reply to Nick Alexander :nalexander from comment #11)
> I need an MDN administrator to remove
> https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API/
> JavaAddonManager.jsm.  I've already removed the link from
> https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API.
> 
> Since this API has never gained traction, I don't think we need to go to the
> effort of deprecating it on MDN.  (We're not doing that in the product
> itself.)

Removed. Let me know if there's anything else you need.