776794 - Statically enumerate permissions grantable by PContentPermissionRequest

Status: NEW

(Core :: DOM: Core & HTML, task, P5)

Description

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

Right now we send a raw string permission.  Instead, we should create a union of dynamically-grantable permissions and send that.

I hope we have code at a lower level that rejects dynamic requests for telephony, e.g., but we shouldn't play with fire here.

Comment 1

[Andrew Overholt [:overholt]]

I forget why we're blocked on input here.  Can anyone enlighten me?

Comment 2

[Dietrich Ayala (:dietrich)]

Per cjones, needs Jonas' analysis to determine if there's work here or not.

Comment 3

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Sending this over to Dougt who is looking at all the prompting stuff.

Comment 4

[Doug Turner (:dougt)]

Is your vision that the parent process tells the child process "here are the 4 permissions you have for right now"?

Comment 5

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

From my reading of the code, it looked like PContentPermissionRequest was behaving as expected, for dynamically-grantable permissions.  For example, it is behaving as expected for granting non-certified permissions like offline storage.

HOWEVER, we should not even allow the possiblity of content processes accidentally requesting permissions like sms or telephony through PContentPermissionRequest.  We should be summarily denying dynamic requests for those permissions at a lower level, but it makes me nervous to even expose that interface.

Statically enumerating the grantable permissions, through an IPDL |union|, would eliminate this problem entirely.

Comment 6

[Chris Jones [:cjones] inactive; ni?/f?/r? if you need me]

(In reply to Doug Turner (:dougt) from comment #4)
> Is your vision that the parent process tells the child process "here are the
> 4 permissions you have for right now"?

We should be doing that somewhere else, yes.

Comment 7

[Doug Turner (:dougt)]

perfectly clear now.  thanks!

Comment 8

[Doug Turner (:dougt)]

i do not think this should be blocking.

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

I don't quite understand why we want to do this. A PContentPermissionRequest *should* only have the ability to bring up a dialog to the user, which isn't really a sensitive thing if we do it for the "wrong" type of permission.

And more importantly, it *should* only have the ability to do that for permissions that are listed as PROMPT in the permissionmanager for that app, or for permissions that any app/webpage has permission to prompt about (like geolocation). Which means that a PContentPermissionRequest *should* only be able to bring up permission dialogs for things that the content process has permission to prompt about.

So it seems ok to me if someone sends a totally invalid string here.

Of course, I'm not sure if this matches what the current implementation does. But if not we should fix that either way.

Comment 10

[Doug Turner (:dougt)]

unassigning things that I am not working on.

Comment 11

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven't been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.

Comment 12

[Andrey Bienkowski]

https://bugzilla.mozilla.org/show_bug.cgi?id=1548706