856273 - SimplePush: Registrations() should return endpoints of calling app only

Status: RESOLVED FIXED

(Firefox OS Graveyard :: General, defect)

Description

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

PushDB.getAllByManifestURL should actually filter by passed manifest URL

Comment 1

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Attachment: patch

Using mozGetAll() would get all the results.

Switch to using a cursor with the keyrange on the index set to the manifestURL, so that only the calling app's registrations are returned.

Comment 2

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/07d7c9d93b2a

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/07d7c9d93b2a

Comment 4

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

Comment on attachment 731442 [details] [diff] [review]
patch

NOTE: Please see https://wiki.mozilla.org/Release_Management/B2G_Landing to better understand the B2G approval process and landings.

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 822712 
User impact if declined: 
Major. Without this patch, any application can acquire all the registrations on the device and then spam the user with fake notifications which could DoS the phone.

Testing completed: 
Yes

Risk to taking this patch (and alternatives if risky): 
Low since Push is disabled by default.

String or UUID changes made by this patch:
None

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18/rev/af605aabbc94