6
edits
Security/B2G/PermissionReview: Difference between revisions
Jump to navigation
Jump to search
Modification on Gallery
(Modification on Gallery) |
|||
| Line 151: | Line 151: | ||
*"feature-detection" | *"feature-detection" | ||
**Ok: This permission is allowed for privileged apps and has been allowed for Trusted Hosted apps. | **Ok: This permission is allowed for privileged apps and has been allowed for Trusted Hosted apps. | ||
**Used for detect the device memory. | **Used for detect the device memory. We make the app exit if it goes to the background while scanning and if the device has 256mb or less of memory. | ||
**This permission is used for a temporary workaround to bug 1039943 (https://bugzilla.mozilla.org/show_bug.cgi?id=1039943) | **This permission is used for a temporary workaround to bug 1039943 (https://bugzilla.mozilla.org/show_bug.cgi?id=1039943) | ||
*"themeable" | *"themeable" | ||
**NOT OK: CERTIFIED | **NOT OK: CERTIFIED | ||
==== How can make Gallery a hosted app? ==== | |||
Lets focus on the APIs not open to hosted content yet: | |||
*Themeable: Does not seem like a essential feature for the application functionality so this can be disabled without impacting end-user in the short term. | |||
**In the longer term, it does not seem like a dangerous feature to be used by hosted app that want to use the device theme. We should explore if this could be open to other apps. | |||
*NFC: The NFC API is used just for sharing content. So far no FxOS commercial devices support NFC and for a hosted version of the app, the immediate approach would be just disabling this feature as if the device did not support NFC. | |||
**In the longer term, we should assess if parts of the NFC funcionality could be exposed to hosted content or there are different ways to access to use this functionality. | |||
*Feature-detection | |||
**We use this permission for a temporary workaround. This should be fixed on this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1046995 | |||
In conclusion: | |||
*There is just one APIs that is not exposed to hosted content and that could reduce the functionality of a Video Hosted App: NFC. For experimenting purposes we are disabling that functionality from the apps,but we should explore if there is any way to expose that functionality to hosted content, either by opening part of these APIs only or by using a service that expose the functionality (instead of exposing APIs). | |||
*Think about how the themeable capability could be used by any app willing to be “themed”. | |||
*Device Storage: Read/Write: This should be re-assessed as the protection defined for Trusted Hosted Apps does not seem to be enough from a security point of view. | |||
*Feature-detection: We should work on develop a patch for https://bugzilla.mozilla.org/show_bug.cgi?id=1046995 | |||
An example of the possible temporary hosted app following this approach is available at: | |||
https://github.com/telefonicaid/gaia/tree/hosted-web/apps/gallery | |||