The default bug view has changed. See this FAQ.

Expose the idle API only to certified apps

RESOLVED FIXED in mozilla17

Status

()

Core
DOM
RESOLVED FIXED
5 years ago
4 years ago

People

(Reporter: Justin Lebar (not reading bugmail), Assigned: Justin Lebar (not reading bugmail))

Tracking

Trunk
mozilla17
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Assignee)

Description

5 years ago
The idle API is currently available to all webpages.

But per recent discussions on the mailing lists (dev-webapi, "should the idle service be exposed to the unprivileged web?"), we should only expose it to certified apps (and chrome).
(Assignee)

Updated

5 years ago
Assignee: nobody → justin.lebar+bug
(Assignee)

Comment 1

5 years ago
Created attachment 649169 [details] [diff] [review]
Patch, v1
Attachment #649169 - Flags: review?(mounir)
(Assignee)

Updated

5 years ago
Depends on: 780547
(Assignee)

Comment 2

5 years ago
This passes the two idle API tests locally, but just in case:

https://tbpl.mozilla.org/?tree=Try&rev=87837531db53
Comment on attachment 649169 [details] [diff] [review]
Patch, v1

Review of attachment 649169 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/base/Navigator.cpp
@@ +653,5 @@
>    nsCOMPtr<nsPIDOMWindow> win = do_QueryReferent(mWindow);
>    NS_ENSURE_TRUE(win, NS_ERROR_UNEXPECTED);
> +
> +  nsCOMPtr<nsIScriptObjectPrincipal> winSOP = do_QueryInterface(win);
> +  NS_ENSURE_TRUE(winSOP, NS_ERROR_UNEXPECTED);

What about using NodePrincipal() from window->GetExtantDocument()?
Attachment #649169 - Flags: review?(mounir) → review+
(Assignee)

Comment 4

5 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/f10321e6ef51
(Assignee)

Updated

5 years ago
Blocks: 780547
No longer depends on: 780547

Comment 5

5 years ago
(In reply to Justin Lebar [:jlebar] from comment #0)

Yeah. And even for privileged Web apps, I would prefer prompting the user whether to disclose the info. Or the warning when the user knights a page as privileged app has to be very clear about the implications.
https://hg.mozilla.org/mozilla-central/rev/f10321e6ef51
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla17
Idle Timer stop working with System app this morning ... would it be possible because of this bug? |dump(navigator.addIdleObserver);| still return a function though and there were no JavaScript errors.
(Assignee)

Comment 8

5 years ago
(In reply to Tim Guan-tin Chien [:timdream] (MoCo-TW) from comment #7)
> Idle Timer stop working with System app this morning ... would it be
> possible because of this bug? |dump(navigator.addIdleObserver);| still
> return a function though and there were no JavaScript errors.

Were there JS errors when you /called/ the function?

Is the system app a certified app?
(In reply to Justin Lebar [:jlebar] from comment #8)
> (In reply to Tim Guan-tin Chien [:timdream] (MoCo-TW) from comment #7)
> > Idle Timer stop working with System app this morning ... would it be
> > possible because of this bug? |dump(navigator.addIdleObserver);| still
> > return a function though and there were no JavaScript errors.
> 
> Were there JS errors when you /called/ the function?

There wasn't.

> Is the system app a certified app?

I would be surprised if it's not. How do I check that?
(Assignee)

Updated

5 years ago
Depends on: 781076
(Assignee)

Updated

5 years ago
Summary: Expose the idle API only to privileged apps → Expose the idle API only to certified apps
Component: DOM: Mozilla Extensions → DOM
Product: Core → Core
You need to log in before you can comment on or make changes to this bug.