741958 - [Security Review][Action Item]IM in Thunderbird - witter oauth / apiapi use

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance, task)

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

:pauljt - where are we on this review, we had a target set back in Apr?

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

I was waiting on a response from the developer, which I received the end of april. Since Adam took over the thunderbird stuff I send him an email to see if he could take over this review, but not sure if he got that, and I forgot to chase it up.

I either do it, or hand over to adam by the end of the month.

Comment 3

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Note that this feature is planned to be preffed on in thunderbird 15. (which is aurora now, and beta July 17) 

Other relevant parts of the email:

Twitter is part of the IM-in-Thunderbird feature.
The relevant OAuth code is in this file
http://mxr.mozilla.org/comm-central/source/chat/protocols/twitter/twitter.js
starting around the line 370.
If you have done the security review of the BigFiles/FileLink feature,
you may already have reviewed some very similar OAuth code, as it's
actually a fork of the Twitter OAuth code.

Comment 4

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Reviewed the linked code and I don't see any issues.