Confirmed users
184
edits
Marketplace/Reviewers/Apps/Testing: Difference between revisions
Jump to navigation
Jump to search
m
Marketplace/Reviewers/Apps/Testing (view source)
Revision as of 14:35, 27 August 2013
, 27 August 2013spelling
(Security guidelines added) |
m (spelling) |
||
| Line 99: | Line 99: | ||
* Take note of any requested permissions in the manifest. There is a [[Marketplace/Reviewers/Apps/Permissions|Security Checklist]] of available APIs and what they might be used/abused for, as well as in-depth [https://developer.mozilla.org/en-US/docs/Web/Apps/Security_guidelines Security guidelines for developers and reviewers]. | * Take note of any requested permissions in the manifest. There is a [[Marketplace/Reviewers/Apps/Permissions|Security Checklist]] of available APIs and what they might be used/abused for, as well as in-depth [https://developer.mozilla.org/en-US/docs/Web/Apps/Security_guidelines Security guidelines for developers and reviewers]. | ||
* Read the code in all the files one by one, in particular the .js files (thankfully inline js and external files aren't allowed by the CSP), paying attention to how any permissions requested are used. | * Read the code in all the files one by one, in particular the .js files (thankfully inline js and external files aren't allowed by the CSP), paying attention to how any permissions requested are used. | ||
* It may be necessary to search for | * It may be necessary to search for and inspect different parts of the files, or other files, to establish how a particular piece of code is used. The validator is your friend as it highlights possible issues, but beware of false positives, and false negatives! | ||
* Launch the app on the device and give the app a quick try and see what experience a new user would have. | * Launch the app on the device and give the app a quick try and see what experience a new user would have. | ||
* Some apps require a login. If its straightforward you should register as a new user (to see what experience an actual user would have). If the app requires paid credentials; specific details; or isn't in a language you can understand sufficiently you can request a username & password - there is a canned response - with Request Information. | * Some apps require a login. If its straightforward you should register as a new user (to see what experience an actual user would have). If the app requires paid credentials; specific details; or isn't in a language you can understand sufficiently you can request a username & password - there is a canned response - with Request Information. | ||