304972 - Grendel should have plug-in support

Status: RESOLVED WONTFIX

(Grendel Graveyard :: User Interface, enhancement)

Description

[Kieran Maclean]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.7.10) Gecko/20050717 Firefox/1.0.6
Build Identifier: 

Grendel should have plug-in support.

These should be java jars which are loaded durring startup.

There should be an API to allow them to access certain features (see my warning
about security at the end).
This API should not provide the module with access to the server passwords.

Plug-in support could lead to security problems, these should be minimal and the
support should minimise these as far as possible. (This should be locked down in
a similar manor to applets running in a browser.)
I may be paranoid but if security is included at the design stage then it will
minimise the work if it should be a problem.

Reproducible: Always

Steps to Reproduce:

Comment 1

[R.J. Keller]

I couldn't see Plugins being a security issue in Grendel because you'd have to
install them manually.

How about instead of JavaScript JAR files, why not use XUL and JavaScript? I'd
be sorta like macros except distributed in a combined format. Remember that
Rhino includes a Java<->JavaScript bridge so we can easily integrate the two
languages.

Comment 2

[Kieran Maclean]

It could be in JavaScript+XUL, however I thought that Java it's self might be
preferable to some people.

Perhaps some combination of the three would be prefered allowing a developer to
choose the options they prefer.

As for security I wouldn't feel happy with other code having unrestricted access
to the system, that includes the underlying OS because this is an application.
I would feel happier if the plug-in ran under a seporate classloader in a
seportate thread.
Where it can be restrained by a security manager, and the classloader.
This would also allow us to catch any uncaught exceptions and help Grendel
remain stable.

Comment 3

[Matthias Versen [:Matti]]

marking wontfix as grendel is removed from cvs