763931 - SecReview: Expose TCP Socket - Investigate whether to handle cert errors in app or in a b2g system component

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance, task)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

SecReview Action Item bug
Investigate whether to handle cert errors in app or in a b2g system component

Comment 1

[Paul Theriault [:pauljt] (no longer reading bugmail)]

TCPSocket uses existing necko code to create a socket:
http://mxr.mozilla.org/mozilla-central/source/dom/network/src/TCPSocketChild.cpp#90

Just testing now to determine behavior when cert errors are experienced.

Comment 2

[Paul Theriault [:pauljt] (no longer reading bugmail)]

Certificate errors result in connection failure, and the onError function of the socket is fired. The user is not prompted at all.

E.g. given the code below which connects to a socket listening with a self-signed cert, the error function will be called.

function connectSockSSL() {
sock = navigator.mozTCPSocket.open('127.0.0.1', '7778', { binaryType: 'arraybuffer',useSSL:true });
sock.onopen = open;
sock.ondrain = null;
sock.ondata = log
sock.onerror = error
sock.onclose = log
}