764966 - SecReview: navigator.mozPay

Status: VERIFIED FIXED

(mozilla.org :: Security Assurance: Review Request, task, P1)

Description

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

SecReview tracking bug
A new feature is being added to the client for B2G.  This feature will facilitate payments of applications and in-app purchases for the B2G device in Brazil. 

This will require several steps so a sectracker page for activities has been setup: https://wiki.mozilla.org/Security/B2G/navigator.pay

We should also gather the standard info:
1) Who is/are the point of contact(s) for this review?
2) Please provide a short description of the feature / application (e.g. problem solved, use cases, etc.):
3) Please provide links to additional information (e.g. feature page, wiki) if available and not yet included in feature description:
4) Does this request block another bug? If so, please indicate the bug number
5) This review will be scheduled amongst other requested reviews. What is the urgency or needed completion date of this review?
6) To help prioritize this work request, does this project support a goal specifically listed on this quarter's goal list?  If so, which goal?
7) Please answer the following few questions: (Note: If you are asked to describe anything, 1-2 sentences shall suffice.)
7a) Does this feature or code change affect Firefox, Thunderbird or any product or service the Mozilla ships to end users?
7b) Are there any portions of the project that interact with 3rd party services?
7c) Will your application/service collect user data? If so, please describe
8) If you feel something is missing here or you would like to provide other kind of feedback, feel free to do so here (no limits on size):
9) Desired Date of review (if known from https://mail.mozilla.com/home/[e-mail]/Security%20Review.html) and whom to invite.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

[bwalker,ferjmoreno,gal]
I sent email on this but I am going to document it here as well.

We need to get moving on this as it appears timelines are short. Who can help me get these questions answer and the right people in a meeting with the security team for an hour next week to go over this?

Available times/Dates:
Mon 1PM PDT
Wed 1PM PDT
Thu 10AM PDT
Fri 10AM PDT

Comment 2

[Bill Walker [:bwalker] [@wfwalker]]

Curtis, thurs 10am is my least favorite, but this review is very high priority, so pick the best time and I'll make it work.

Comment 3

[Andreas Gal :gal]

Free Monday. Free Wed. Blocked Thu. Blocked Friday. Please send invite.

Comment 4

[Fernando Jiménez Moreno [:ferjm]]

(In reply to Curtis Koenig [:curtisk] from comment #1)
> Available times/Dates:
> Mon 1PM PDT
> Wed 1PM PDT
> Thu 10AM PDT
> Fri 10AM PDT
Any of the times/dates work for me.

[+CC Antonio Amaya, from TEF security team]

Comment 5

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Review Scheduled: Mon-16-July-2012 1pm PDT

https://mail.mozilla.com/home/[e-mail]/Security%20Review.html?view=month&action=view&invId=130654-130653&pstat=AC&exInvId=130654-200727&useInstance=1&instStartTime=1342468800000&instDuration=3600000

Comment 6

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

Moved to 19-July 10am PDT https://mail.mozilla.com/home/[e-mail]/Security%20Review.html?view=month&action=view&invId=110484-110483&pstat=AC&exInvId=110484-200798&useInstance=1&instStartTime=1342717200000&instDuration=3600000

Comment 7

[Raymond Forbes[:rforbes]]

David Chan and I did this while I was in Mountain View.  This is complete.

Comment 8

[Caitlin Galimidi [:c8o]]

@Raymond: can you link to the results of the Security Review?

Comment 9

[Jason Smith [:jsmith]]

(In reply to Caitlin Galimidi from comment #8)
> @Raymond: can you link to the results of the Security Review?

https://wiki.mozilla.org/Security/Reviews/navigator.pay <--- Is that what you are looking for?

Comment 10

[Raymond Forbes[:rforbes]]

dchan and i did a security code review on the nav.pay code, but didn't find any issues so we didn't really have anything written up.