Figure out where we want to expose navigator.mozKeyboard

RESOLVED WONTFIX

Status

()

RESOLVED WONTFIX
5 years ago
4 years ago

People

(Reporter: Ehsan, Unassigned)

Tracking

Trunk
x86
Mac OS X
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

5 years ago
This API should definitely not be visible to Web content anywhere (desktop/Android/Firefox OS).  We currently use a JavaScript-navigator-property manifest entry to expose this on navigator unconditionally, and we need to switch that to do the proper checks.  Is this API supposed to be enabled for apps with a specific permission?
(Reporter)

Comment 1

5 years ago
(The check in MozKeyboard.init seems to suggest that this should be hidden based on the "input-manage" permission, but we may want to enable it based on a pref if needed too.)
(In reply to :Ehsan Akhgari (needinfo? me!) (slow responsiveness, emailacopolypse) from comment #0)
> This API should definitely not be visible to Web content anywhere
> (desktop/Android/Firefox OS).  We currently use a
> JavaScript-navigator-property manifest entry to expose this on navigator
> unconditionally, and we need to switch that to do the proper checks.  Is
> this API supposed to be enabled for apps with a specific permission?

Yes, mozKeyboard API should be only enabled for certified app with the "input-manage" permission.
(In reply to :Ehsan Akhgari (needinfo? me!) (slow responsiveness, emailacopolypse) from comment #1)
> (The check in MozKeyboard.init seems to suggest that this should be hidden
> based on the "input-manage" permission, but we may want to enable it based
> on a pref if needed too.)
Currently navigator.mozKeyboard will be disabled if there is no "input-manage" permission and we need a pref, such as 
"dom.mozKeyboard.enabled" to hide it on desktop and android. 

mozKeyboard API should be only exposed to the certified app with the "input-manage" permission.
navigator.mozKeyboard has been deprecated. We should remove it, it's just that we have some parts not transferred to mozInputMethod yet that are needed in system.
So are we going to either remove this API or at least get rid of the dump()?

I was concerned to see this in my console in a current FF30 beta:

  No permission to use the keyboard API for http://googleads.g.doubleclick.net

And tracked down this bug (and bug 969897, and bug 838308) to figure out what the heck was going on.
And I'm not the only one, it showed up in Google's search suggestions because there are a ton of hits:

https://www.google.com/?gws_rd=ssl#q=no+permission+to+use+the+keyboard+api+for+http+%2F%2Fgoogleads.g.doubleclick.net
mozKeyboard has been removed by bug 986992 in FF31.
Status: NEW → RESOLVED
Last Resolved: 4 years ago
Depends on: 986992
Resolution: --- → FIXED
Resolution: FIXED → WONTFIX
You need to log in before you can comment on or make changes to this bug.