797901 - Don't place call when the dial activity is started

Status: VERIFIED FIXED

(Firefox OS Graveyard :: Gaia, defect, P1)

Description

[Mounir Lamouri (:mounir)]

This is a *HUGE* security issue.
Any page can do:
new Activity({ name: "dial", data: { number: "somenumber" } });

and that will just place a call... We should not allow that and just show the number and let the user press the call button.

That's the entire security philosophy of Web Activities that have been ruined...

Comment 1

[Mounir Lamouri (:mounir)]

Attachment: Patch

Comment 2

[Etienne Segonzac (:etienne)]

Francisco, can you point

Comment 3

[Etienne Segonzac (:etienne)]

Hey Ayman, found your bugzilla handle.

This is reverting back a change made for UX purpose (IIRC).

First I'd like to make sure that the security issue is well understood (currently any website can start a phone call without user confirmation).

But also, if you have an alternative solution that would satisfy the spec and the security concerns we're listening.

Comment 4

[Mounir Lamouri (:mounir)]

POC: http://oldworld.fr/mozilla/tel.html

Loading the page from a B2G phone will try to call "00000000" without any user interaction.

Comment 5

[Francisco Jordano [:arcturus] [:francisco]]

Hi Ayman,

I think this has been discussed heavily even it's the better option to go ahead with the patch by Mounir.

Also checked with the security people from MOZ, TEF and mainly everyone else and it's the ONLY wayt to go.

Cheers!

Comment 6

[Etienne Segonzac (:etienne)]

Mounir, can you attach a |git format-patch| patch here or send a pull request to gaia?

Comment 7

[Mounir Lamouri (:mounir)]

https://github.com/mozilla-b2g/gaia/pull/5712

Comment 8

[Etienne Segonzac (:etienne)]

https://github.com/mozilla-b2g/gaia/pull/5712

Comment 9

[Angela Hubenya]

verified as fixed using Unagi, build 20130102070202