763052 - Add logic to detect new sensitive permissions for re-review

Status: RESOLVED INVALID

(Marketplace Graveyard :: Reviewer Tools, defect, P4)

Description

[Rob Hudson [:robhudson]]

Detect new sensitive permissions and place in re-review queue.

Comment 1

[Wil Clouser [:clouserw]]

Matching priority of blocking bug

Comment 2

[Andrew Williamson [:eviljeff]]

Is this bug still valid?  Only packaged apps will have sensitive permissions (right?) and each version will be reviewed anyway rather than being selectively flagged in the re-review queue.

(please reopen if this isn't the case)

Comment 3

[Christopher Van Wiemeersch [:cvan]]

What happens if a hosted (manifest) app starts asking for new permissions?

Comment 4

[Andrew Williamson [:eviljeff]]

(In reply to Chris Van Wiemeersch [:cvan] from comment #3)
> What happens if a hosted (manifest) app starts asking for new permissions?

from what I understand hosted apps can't get sensitive permissions:
https://wiki.mozilla.org/Apps/Security#Open_Web_Apps_Security_and_Privacy_Model
(disclaimer: I only skim-read that page :) )

Comment 5

[Christopher Van Wiemeersch [:cvan]]

(In reply to Andrew Williamson [:eviljeff] from comment #4)
> (In reply to Chris Van Wiemeersch [:cvan] from comment #3)
> > What happens if a hosted (manifest) app starts asking for new permissions?
> 
> from what I understand hosted apps can't get sensitive permissions:
> https://wiki.mozilla.org/Apps/
> Security#Open_Web_Apps_Security_and_Privacy_Model
> (disclaimer: I only skim-read that page :) )

Yeah I understand they don't receive sensitive permissions but it's unclear to me what happens if an app requests them. I assume we fail silently? I don't know?

Comment 6

[Wil Clouser [:clouserw]]

(In reply to Chris Van Wiemeersch [:cvan] from comment #5)
> (In reply to Andrew Williamson [:eviljeff] from comment #4)
> > (In reply to Chris Van Wiemeersch [:cvan] from comment #3)
> > > What happens if a hosted (manifest) app starts asking for new permissions?
> > 
> > from what I understand hosted apps can't get sensitive permissions:
> > https://wiki.mozilla.org/Apps/
> > Security#Open_Web_Apps_Security_and_Privacy_Model
> > (disclaimer: I only skim-read that page :) )
> 
> Yeah I understand they don't receive sensitive permissions but it's unclear
> to me what happens if an app requests them. I assume we fail silently? I
> don't know?

I'd expect it to be ignored, yeah.