Last Comment Bug 780507 - Expose the idle API only to certified apps
: Expose the idle API only to certified apps
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: DOM (show other bugs)
: Trunk
: All All
: -- normal with 1 vote (vote)
: mozilla17
Assigned To: Justin Lebar (not reading bugmail)
:
Mentors:
Depends on: 781076
Blocks: 715041 780547
  Show dependency treegraph
 
Reported: 2012-08-05 13:37 PDT by Justin Lebar (not reading bugmail)
Modified: 2013-04-04 13:53 PDT (History)
8 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Patch, v1 (1.30 KB, patch)
2012-08-05 20:50 PDT, Justin Lebar (not reading bugmail)
mounir: review+
Details | Diff | Splinter Review

Description Justin Lebar (not reading bugmail) 2012-08-05 13:37:34 PDT
The idle API is currently available to all webpages.

But per recent discussions on the mailing lists (dev-webapi, "should the idle service be exposed to the unprivileged web?"), we should only expose it to certified apps (and chrome).
Comment 1 Justin Lebar (not reading bugmail) 2012-08-05 20:50:50 PDT
Created attachment 649169 [details] [diff] [review]
Patch, v1
Comment 2 Justin Lebar (not reading bugmail) 2012-08-05 21:02:22 PDT
This passes the two idle API tests locally, but just in case:

https://tbpl.mozilla.org/?tree=Try&rev=87837531db53
Comment 3 Mounir Lamouri (:mounir) 2012-08-06 08:34:38 PDT
Comment on attachment 649169 [details] [diff] [review]
Patch, v1

Review of attachment 649169 [details] [diff] [review]:
-----------------------------------------------------------------

::: dom/base/Navigator.cpp
@@ +653,5 @@
>    nsCOMPtr<nsPIDOMWindow> win = do_QueryReferent(mWindow);
>    NS_ENSURE_TRUE(win, NS_ERROR_UNEXPECTED);
> +
> +  nsCOMPtr<nsIScriptObjectPrincipal> winSOP = do_QueryInterface(win);
> +  NS_ENSURE_TRUE(winSOP, NS_ERROR_UNEXPECTED);

What about using NodePrincipal() from window->GetExtantDocument()?
Comment 4 Justin Lebar (not reading bugmail) 2012-08-06 09:36:12 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/f10321e6ef51
Comment 5 Nicolas Barbulesco 2012-08-06 11:55:26 PDT
(In reply to Justin Lebar [:jlebar] from comment #0)

Yeah. And even for privileged Web apps, I would prefer prompting the user whether to disclose the info. Or the warning when the user knights a page as privileged app has to be very clear about the implications.
Comment 6 Ryan VanderMeulen [:RyanVM] 2012-08-06 17:11:06 PDT
https://hg.mozilla.org/mozilla-central/rev/f10321e6ef51
Comment 7 Tim Guan-tin Chien [:timdream] (please needinfo) 2012-08-06 22:46:32 PDT
Idle Timer stop working with System app this morning ... would it be possible because of this bug? |dump(navigator.addIdleObserver);| still return a function though and there were no JavaScript errors.
Comment 8 Justin Lebar (not reading bugmail) 2012-08-07 05:10:55 PDT
(In reply to Tim Guan-tin Chien [:timdream] (MoCo-TW) from comment #7)
> Idle Timer stop working with System app this morning ... would it be
> possible because of this bug? |dump(navigator.addIdleObserver);| still
> return a function though and there were no JavaScript errors.

Were there JS errors when you /called/ the function?

Is the system app a certified app?
Comment 9 Tim Guan-tin Chien [:timdream] (please needinfo) 2012-08-07 19:59:15 PDT
(In reply to Justin Lebar [:jlebar] from comment #8)
> (In reply to Tim Guan-tin Chien [:timdream] (MoCo-TW) from comment #7)
> > Idle Timer stop working with System app this morning ... would it be
> > possible because of this bug? |dump(navigator.addIdleObserver);| still
> > return a function though and there were no JavaScript errors.
> 
> Were there JS errors when you /called/ the function?

There wasn't.

> Is the system app a certified app?

I would be surprised if it's not. How do I check that?

Note You need to log in before you can comment on or make changes to this bug.