744946 - SDK Support for Firefox for Mobile Addons

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task, P2)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Who is/are the point of contact(s) for this review?
    
Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
    
Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
    
Does this request block another bug? If so, please indicate the bug number This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?

Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)

Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?

Are there any portions of the project that interact with 3rd party services?

Will your application/service collect user data? If so, please describe 

If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):

Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 1

[David Mason [:dcm :dmason]]

cc'd Matteo as he has done the most work on mobile to date - also cc'd irakli as he's the jetpack tech-lead

Comment 2

[Matteo Ferretti [:zer0] [:matteo]]

My deepest apologies for the delay, I'm available for the sec review this Friday 22 or Monday 25. I should be available also the 2nd of July and the 4th.

> Please provide a short description of the feature / application (e.g. problem
> solved, use cases, etc.):

Makes SDK working on Firefox Mobile (Fennec)

> Please provide links to additional information (e.g. feature page, wiki) if
> available and not yet included in feature description:

Only few modules are ported, we're going to import more of them. Some additional details can be found here:
<https://addons.mozilla.org/en-US/developers/docs/sdk/latest/dev-guide/tutorials/mobile.html>
At the moment the feature is marked as experimental.

> Does this feature or code change affect Firefox, Thunderbird or any product 
> or service the Mozilla ships to end users?

No. At least, not directly. Of course this feature helps to create add-on on Fennec, so an add-on made in using that feature it could be able to "affect" Fennec.

> Are there any portions of the project that interact with 3rd party services?

No. At least, not directly as above. An add-on could interact with 3rd party services.

> Will your application/service collect user data? If so, please describe 

No. At least, not directly as above. An add-on could collect user data.

Comment 3

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Risk/Priority Ranking Exercise https://wiki.mozilla.org/Security/RiskRatings

Priority: 2 (P4) - Team Quarterly Goal

Operational: 0 - N/A
User: 0 - N/A
Privacy: 2 - Normal
Engineering: 5 - Blocker
Reputational: 3 - Major

Priority Score: 27

Comment 4

[Mark Goodwin [:mgoodwin]]

Matteo, please ping me when you've got some time to talk me through this.

Comment 5

[Matteo Ferretti [:zer0] [:matteo]]

Hi Mark, I'm available today if you have time. Otherwise let me know, we can arrange something in the coming days. You can also find me on IRC too (nickname: ZER0).

Comment 6

[Mark Goodwin [:mgoodwin]]

There's very little fennec specific in the SDK. There are a couple of new cfx commands (these expose the developer, not the user) and a couple of re-implementations of existing functionality broken from the move to the native UI (relating to tabs and windows, for example).

I've looked at the fennec specific code and I'm happy we're not exposing addon devs (and therefore users of the addons they write) to things they don't expect.