932795 - Remove unnecessary systemXHR permission

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Video, defect)

Description

[Stephanie Ouillon [:arroway] (needinfo me)]

The systemXHR privileged permission should be removed from the manifest of the Video app since it is not longer required. Tt was previously used to make calls to the Youtube API, which is no longer performed.

Comment 1

[Daniel Veditz [:dveditz]]

Not a current vulnerability so we don't need to hide the bug, but we do want to fix it (it's trivial to do) since it potentially raises the risk should this app be compromised.

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: patch v0

(had some minutes to spare as I got too bored at an airport)

I think this might fix the issue, please let me know if there is anything else I should change.

Comment 3

[Dale Harvey (:daleharvey)]

Comment on attachment 825093 [details] [diff] [review]
patch v0

Before you land this remember to take the semi colon off preceeding line "audio-channel-content":{}, (or if you need me to land, up an updated patch)

In future djf oh John Hu are likely better reviewers, I dont work on Video these days

Cheers, looks good

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: patch v1

Bringing over r+.

> In future djf oh John Hu are likely better reviewers, I dont work on Video
> these days

I chose you based on the shortest review queue from the "suggested reviewers" list - djf had 16 at that time, while John Hu wasn't on the list (no idea why).

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Does this need to be backported?

Comment 6

[Dale Harvey (:daleharvey)]

https://github.com/mozilla-b2g/gaia/commit/8179e273ebf9c1384f57a0813394bef294b51aad

Comment 7

[Josh Matthews [:jdm]]

(In reply to Gary Kwong [:gkw] [:nth10sd] (still catching up on bugmail) (in-n-out through Nov 5) from comment #4)
> Created attachment 825894 [details] [diff] [review]
> patch v1
> 
> Bringing over r+.
> 
> > In future djf oh John Hu are likely better reviewers, I dont work on Video
> > these days
> 
> I chose you based on the shortest review queue from the "suggested
> reviewers" list - djf had 16 at that time, while John Hu wasn't on the list
> (no idea why).

Sounds like someone should file a bug requesting that he be added.

Comment 8

[David Flanagan [:djf]]

Thanks for the patch Gary, and thanks for landing it, Dale.

I don't know if this should be backported.  (Actually, I'm not certain when we stopped using the youtube api, but if we can remove this permission in 1.2, I think we should. It is basically risk-free to do.

Let's ask the reporter: Stephanie, do you want to nominate this fix koi?

Comment 9

[Stephanie Ouillon [:arroway] (needinfo me)]

The use of the Youtube API has been stopped 4 months ago, I think it would be good to remove the permission in 1.2.

Comment 10

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Josh Matthews [:jdm] from comment #7)
> Sounds like someone should file a bug requesting that he be added.

I filed bug 935286.

Comment 11

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This permission was recommended to be removed in the security review of the Video app:

https://wiki.mozilla.org/Security/Reviews/Gaia/Video#Permissions

Comment 12

[bhavana bajaj [:bajaj]]

So this seems to be more of a want from the security team as a preventive case, please clarify if that's not the case, as we do not want to block on an issue if its not absolutely critical. Are we sure that no older releases(1.0.1,1.1) will rely on this change ? Would we need any new testing here ?

Comment 13

[Stephanie Ouillon [:arroway] (needinfo me)]

The permission can be removed from 1.2 but not from older releases, as 1.1 and 1.0.1 still use the Youtube API in the Video app.

Comment 14

[David Flanagan [:djf]]

I don't have the rights to mark this koi+, but I would if I did. It seems like a risk-free security patch. I think we should uplift it.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

John, can you please assist? :)

Comment 16

[John Ford [:jhford] CET/CEST Berlin Time]

[v1.2 487853e] Bug 932795 - remove unused systemXHR permission. r=daleharvey