719238 - Detect sensitive APIs used in apps

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Add-on Builder, defect, P2)

Description

[Wil Clouser [:clouserw]]

This bug is for detecting the use of sensitive/privileged APIs in app manifests.  We can start with the geolocation API.  This bug is a placeholder for now as:

1) We don't have the complete list of sensitive APIs
2) We don't have documentation for how to detect the sensitive APIs

mhanson and dchan are proposing something this week and the feedback for that should be done elsewhere but I wanted this bug filed. :)

Comment 1

[Wil Clouser [:clouserw]]

Should Justin be owning this bug?  What is the status?

Comment 2

[David Chan [:dchan]]

Is this bug still on the roadmap?

This bug doesn't seem to apply for v1 since only Mozilla will create certified apps and only certified apps get interesting permissions.

Comment 3

[Fred Wenzel [:wenzel]]

(In reply to David Chan [:dchan] from comment #2)
> This bug doesn't seem to apply for v1 since only Mozilla will create
> certified apps and only certified apps get interesting permissions.

That's not true, at least hopefully.

There are a number of "requires permission" APIs available to privileged 3rd party apps. There's an additional number of APIs only available to certified apps. In the interest of developers, the former should be the rule, unless we have a very very good reason to require certification for APIs (such as the dialer API).

Comment 4

[David Chan [:dchan]]

From http://mxr.mozilla.org/mozilla-central/source/dom/apps/src/PermissionsInstaller.jsm

The list of ALLOW permissions for privileged apps is
["resource-lock", "alarms", "tcp-socket", "browser", "fmradio", "systemXHR"]

and PROMPT permissions is
["geolocation", "camera", "contacts", "device-storage:apps", "device-storage:pictures", "device-storage:videos", "device-storage:music", "device-storage:sdcard", "wifi"]

I thought the set was smaller, but you're right :wenzel. From the above list, the most concerning to me are the tcp-socket and systemXHR permission since it allows data ex-filtration. 

The other permissions may or may not be dangerous in the absence of tcp-socket / systemXHR. The PROMPT permissions provide a way for an app to retrieve user data, but that may not be useful without a way to get the data off the device.

Comment 5

[Wil Clouser [:clouserw]]

The builder project has been discontinued as of April 1st, 2014.

The announcement last year: https://blog.mozilla.org/addons/2013/12/18/add-on-builder/

Next steps (still being written): https://developer.mozilla.org/en-US/Add-ons/SDK/Builder