1480806 - Remove javascript intent filter if unused

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: General, enhancement)

Description

[Petru-Mugurel Lingurar [:petru]]

We are registering an Intent filter for URLs using the javascript:// scheme [1]. There are concerns that this could be or become exploitable. If not needed we should remove this filter (Although note that Chrome registers for javascript:// URLS too [2]).

[1] https://dxr.mozilla.org/mozilla-central/rev/a2d65d03e46a9a42b5bee5c2a7864d3f987a8ca7/mobile/android/base/AndroidManifest.xml.in#93
[2] https://cs.chromium.org/chromium/src/chrome/android/java/AndroidManifest.xml?rcl=0c86b6bef6a1eafe81390c58bc4c0ae07e4865a3&l=232

Comment 1

[Petru-Mugurel Lingurar [:petru]]

Attachment: Bug 1480806 - Remove javascript intent filter if unused

Comment 2

[Petru-Mugurel Lingurar [:petru]]

Try build with this patch - https://treeherder.mozilla.org/#/jobs?repo=try&revision=e1b703e36554c80b258e69e0ff3cd2a5f0d19a5a

Comment 3

[(inactive) Jim Chen [:jchen] [:darchons]]

Comment on attachment 8999158 [details]
Bug 1480806 - Remove javascript intent filter if unused

Jim Chen [:jchen] [:darchons] has approved the revision.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/edf053871a39
Remove javascript intent filter if unused r=jchen

Comment 5

[Andrei Ciure[:aciure]]

https://hg.mozilla.org/mozilla-central/rev/edf053871a39