805496 - desktop.js is doing stuff in the Comms app while running on the device

Status: RESOLVED DUPLICATE of bug 849115

(Firefox OS Graveyard :: Gaia, defect)

Description

[Etienne Segonzac (:etienne)]

See 

|A call to document.write() from an asynchronously-loaded external script was ignored.|

when lauching the Dialer.

I'm not sure why this debugging file is systematically loaded anyway, but if it's also doing stuff while on the device and generating warnings it's really bad.

Let's not ship a phone with that :)

Comment 1

[Mark Finkle (:mfinkle) (use needinfo?)]

What kind of problems do we think this creates? Can the phone be hacked or exploited in some way? 

Simply showing warnings in the log is not enough to block.

Comment 2

[Francisco Jordano [:arcturus] [:francisco]]

Mark,

this problem is related to CSP in general and we will need to get rid of it ASAP.

Thanks,
F.

Comment 3

[Francisco Jordano [:arcturus] [:francisco]]

(In reply to Francisco Jordano (:arcturus) from comment #2)
> Mark,
> 
> this problem is related to CSP in general and we will need to get rid of it
> ASAP.
> 
> Thanks,
> F.

Thanks to Alberto and Antonio comments, this is not related to CSP, is related to the inclusion of debug code that is suppose to be running just in the Firefox version, not suppose to be running in the device.

Comment 4

[Tony Chung [:tchung]]

Blocking-, until someone provides an explanation how this affects user impact.

Comment 5

[Francisco Jordano [:arcturus] [:francisco]]

desktop.js is code that we use to support some apis that are not available outside the phone, when we want to check in the browser for example.

IMHO, and taking into account minimum phone resources and how we need to maximize them, removing this is necessary. It will affect the user, slowing down the apps in which this is being executed without need.

Comment 6

[Kevin Grandon :kgrandon]

Desktop.js was removed from gaia master for bug #849115. It still exists in v1-train though, but should have very little impact at this point as it's only currently included in sms in v1-train.

Marking as duplicate for tracking purposes.