Remove Java Addons support from Fennec

RESOLVED FIXED in Firefox 55

Status

()

Firefox for Android
General
RESOLVED FIXED
4 months ago
4 months ago

People

(Reporter: nalexander, Assigned: nalexander)

Tracking

({addon-compat, dev-doc-complete})

unspecified
Firefox 55
addon-compat, dev-doc-complete
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox55 fixed)

Details

MozReview Requests

()

Submitter Diff Changes Open Issues Last Updated
Loading...
Error loading review requests:

Attachments

(1 attachment)

Bug 794479 and later bugs like Bug 1168407 added support for add-ons to dynamically inject compiled Java classes (in the form of DEX files) into the Fennec process and pass messages between the injected Java code and the JavaScript code in the add-on.

This functionality was intended to grow into a robust API for add-ons to interact with the Android system.  This didn't happen: I'm not aware of a single consumer, although I haven't searched thoroughly.  (Certainly there has never been a bug report, a question about how to use the system, or a feature request for extensions.)  The only use case I know of was that I used the approach to build a proof of concept that integrated with a potential partner's Java safe-browsing API.

This ticket tracks removing this functionality entirely.  The Java Addon approach doesn't make sense in a Web Extensions-only world, where we want to dramatically reduce the API surface area that the browser needs to support.  And it doesn't make sense to invest in documenting and testing this feature.  It doesn't make sense to allow code injection as we continue to try to secure Fennec and keep browser crashes down.  It doesn't make sense to build features for potential partners in this way: we've had success modifying the in-tree code for partners.

Let's simplify our code base, reduce our attack surface, and cull an edge-case from the build system!
sebastian: as the technical owner of Fennec, do you agree with removing Java Addons from Fennec?
Flags: needinfo?(s.kaspari)
James, Barbara, Maria -- flagging product people in case there's some product use case I don't know about, past, present, or future.

Mike -- flagging you since this could be relevant to distributions.

Max -- flagging you since this would simplify the transition to the Gradle build system.
Flags: needinfo?(mpopova)
Flags: needinfo?(jacheng)
Flags: needinfo?(bbermes)
I think we'd WONTFIX Bug 799631 and any others we found as well.
Blocks: 1119520
Depends on: 794479

Comment 4

4 months ago
These APIs aren't used in distros.
(In reply to Nick Alexander :nalexander from comment #1)
> sebastian: as the technical owner of Fennec, do you agree with removing Java
> Addons from Fennec?

Yeah, I agree. We do not want to load arbitrary Java code and keeping this is counter-productive to the add-ons roadmap.
Flags: needinfo?(s.kaspari)
Comment hidden (mozreview-request)
Assignee: nobody → nalexander
Thanks for the ni, I agree and basically we're not dealing with Addons on Fennec so I have no concern about this.
Flags: needinfo?(jacheng)

Comment 8

4 months ago
mozreview-review
Comment on attachment 8863855 [details]
Bug 1361418 - Remove Java Addons from Firefox for Android.

https://reviewboard.mozilla.org/r/135590/#review138812
Attachment #8863855 - Flags: review?(s.kaspari) → review+
Clearing NI from additional product folks.  Sorry for the noise, Barbara and Maria!
Flags: needinfo?(mpopova)
Flags: needinfo?(bbermes)

Comment 10

4 months ago
Pushed by nalexander@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/801705332e54
Remove Java Addons from Firefox for Android. r=sebastian
I need an MDN administrator to remove https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API/JavaAddonManager.jsm.  I've already removed the link from https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API.

Since this API has never gained traction, I don't think we need to go to the effort of deprecating it on MDN.  (We're not doing that in the product itself.)
Keywords: dev-doc-needed

Comment 12

4 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/801705332e54
Status: NEW → RESOLVED
Last Resolved: 4 months ago
status-firefox55: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → Firefox 55
(In reply to Nick Alexander :nalexander from comment #11)
> I need an MDN administrator to remove
> https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API/
> JavaAddonManager.jsm.  I've already removed the link from
> https://developer.mozilla.org/en-US/Add-ons/Firefox_for_Android/API.
> 
> Since this API has never gained traction, I don't think we need to go to the
> effort of deprecating it on MDN.  (We're not doing that in the product
> itself.)

Removed. Let me know if there's anything else you need.
Keywords: dev-doc-needed → dev-doc-complete

Updated

4 months ago
Blocks: 1363843
Keywords: addon-compat
You need to log in before you can comment on or make changes to this bug.