642726 - Client security review

Status: RESOLVED INVALID

(Mozilla Labs :: F1, defect)

Description

[Philipp von Weitershausen [:philikon]]

Need to get security review for the addon, the JS web client and particularly their interaction.

Comment 1

[Philipp von Weitershausen [:philikon]]

Johnny suggested I'd CC Jonas, bz and Blake on this, so here we go:  The Services team has been asked to integrate the "F1" add-on into Firefox. Target release is Firefox 5 which is to branch in a matter of weeks.

Under the hood F1 is three things:
* a server that takes incoming share requests and performs them on the respective service (twitter, facebook, etc.). This component is outside the scope of this bug and will receive security review by the infrasec team, AFIUI.
* a web client that drives the share UI. It consists of static HTML and JS pages served off the web. It stores state (account profiles and OAuth tokens) right now using localStorage, though we're planning to change that (bug 642660). It communicates with the Firefox chrome code using postMessage.
* a small bit of Firefox integration code that loads the web client in an iframe. It pushes information like the URL, title, thumbnail, etc. into the web client using postMessage.

The objective of this bug is to vet the interaction between the two client bits: the web client and the surrounding Firefox chrome code. Their shared "API" has been documented here: https://github.com/mozilla/f1/wiki/Addon-Web-Data-API%3A-v0. As described in that document, there are plans to refactor some details, but the overall design of using postMessage to communicate between chrome and web level code will remain.

Comment 2

[Philipp von Weitershausen [:philikon]]

This bug should have an owner. Assigning it to dchan since he's been doing lots of reviewing already.

Comment 3

[Shane Caraveo (:mixedpuppy)]

To my understanding there is an openwebapps security review August 26 @ 1:00, which will includes review for F1 based on webapps.

Comment 5

[Bryan Clark (DevTools PM) [:clarkbw]]

f1 is no longer an active project.  delete these messages by searching for: [closing_f1_project_bugs]