780507 - Expose the idle API only to certified apps

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Justin Lebar (not reading bugmail)]

The idle API is currently available to all webpages.

But per recent discussions on the mailing lists (dev-webapi, "should the idle service be exposed to the unprivileged web?"), we should only expose it to certified apps (and chrome).

Comment 1

[Justin Lebar (not reading bugmail)]

Attachment: Patch, v1

Comment 2

[Justin Lebar (not reading bugmail)]

This passes the two idle API tests locally, but just in case:

https://tbpl.mozilla.org/?tree=Try&rev=87837531db53

Comment 3

[Mounir Lamouri (:mounir)]

Comment on attachment 649169 [details] [diff] [review]
Patch, v1

Review of attachment 649169 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/base/Navigator.cpp
@@ +653,5 @@
>    nsCOMPtr<nsPIDOMWindow> win = do_QueryReferent(mWindow);
>    NS_ENSURE_TRUE(win, NS_ERROR_UNEXPECTED);
> +
> +  nsCOMPtr<nsIScriptObjectPrincipal> winSOP = do_QueryInterface(win);
> +  NS_ENSURE_TRUE(winSOP, NS_ERROR_UNEXPECTED);

What about using NodePrincipal() from window->GetExtantDocument()?

Comment 4

[Justin Lebar (not reading bugmail)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/f10321e6ef51

Comment 5

[Nicolas Barbulesco]

(In reply to Justin Lebar [:jlebar] from comment #0)

Yeah. And even for privileged Web apps, I would prefer prompting the user whether to disclose the info. Or the warning when the user knights a page as privileged app has to be very clear about the implications.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f10321e6ef51

Comment 7

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Idle Timer stop working with System app this morning ... would it be possible because of this bug? |dump(navigator.addIdleObserver);| still return a function though and there were no JavaScript errors.

Comment 8

[Justin Lebar (not reading bugmail)]

(In reply to Tim Guan-tin Chien [:timdream] (MoCo-TW) from comment #7)
> Idle Timer stop working with System app this morning ... would it be
> possible because of this bug? |dump(navigator.addIdleObserver);| still
> return a function though and there were no JavaScript errors.

Were there JS errors when you /called/ the function?

Is the system app a certified app?

Comment 9

[Tim Guan-tin Chien [:timdream] (please needinfo)]

(In reply to Justin Lebar [:jlebar] from comment #8)
> (In reply to Tim Guan-tin Chien [:timdream] (MoCo-TW) from comment #7)
> > Idle Timer stop working with System app this morning ... would it be
> > possible because of this bug? |dump(navigator.addIdleObserver);| still
> > return a function though and there were no JavaScript errors.
> 
> Were there JS errors when you /called/ the function?

There wasn't.

> Is the system app a certified app?

I would be surprised if it's not. How do I check that?