Firefox3/OfflineApps Security Review - Revision history

Dveditz: /* Review Comments */

2008-09-08T22:06:43Z

Review Comments

← Older revision		Revision as of 22:06, 8 September 2008
Line 86:		Line 86:
	** should it be per-manifest?		** should it be per-manifest?
	* if we crash during caching, file will be written but not indexed. Will it get cleaned up?		* if we crash during caching, file will be written but not indexed. Will it get cleaned up?
			* fallback mode seems under-specified
			* fallback must be limited to same-origin

Dveditz: /* Review Comments */

2008-09-08T21:54:33Z

Review Comments

← Older revision		Revision as of 21:54, 8 September 2008
Line 78:		Line 78:

	== Review Comments ==		== Review Comments ==
			* caching rules differ from regular cache? Will always load cached copy if there is one.
			* are SSL pages cached, even though we normally don't?
			* What about cache-control: settings?
			* Once a page has an "offlineable" cache, all network loads must be specified in the manifest.
			* opt-in is per domain...
			** Should AT LEAST be scheme-host-port origins.
			** should it be per-manifest?
			* if we crash during caching, file will be written but not indexed. Will it get cleaned up?

Dveditz at 21:06, 8 September 2008

2008-09-08T21:06:59Z

← Older revision		Revision as of 21:06, 8 September 2008
Line 1:		Line 1:
	~~__NOTOC__~~
	== Overview ==		== Overview ==

Line 77:		Line 76:
	* If so, what is the proposal's relationship to their work? Do you depend on others' work, or vice-versa?		* If so, what is the proposal's relationship to their work? Do you depend on others' work, or vice-versa?
	* Are you updating, copying or changing functional areas maintained by other groups? How are you coordinating and communicating with them? Do they "approve" of what you propose?		* Are you updating, copying or changing functional areas maintained by other groups? How are you coordinating and communicating with them? Do they "approve" of what you propose?

			== Review Comments ==

DCamp: /* Module interactions */

2008-09-08T18:14:07Z

Module interactions

← Older revision		Revision as of 18:14, 8 September 2008
Line 46:		Line 46:
	== Module interactions ==		== Module interactions ==
	* What other modules are used (REQUIRES in the makefile, interfaces)		* What other modules are used (REQUIRES in the makefile, interfaces)
			** The implementations of nsSecurityManager::SecurityCompareURIs and nsContentUtils::OfflineAppAllowed were moved into nsNetUtil.h so that it could be used in netwerk/
			** content/base/src added a REQUIRES on nkcache to access nsICachingChannel.h during cache selection.

	== Data ==		== Data ==

DCamp: /* Security and Privacy */

2008-09-08T18:02:23Z

Security and Privacy

← Older revision		Revision as of 18:02, 8 September 2008
Line 20:		Line 20:

	== Security and Privacy ==		== Security and Privacy ==
	* What security issues do you address in your project?
	* Is system or subsystem security compromised in any way if your project's configuration files / prefs are corrupt or missing?
	* Include a thorough description of the security assumptions, capabilities and any potential risks (possible attack points) being introduced by your project.

	* A manifest can list an explicit entry that is not same-origin with the application. Say we have a manifest at http://application.com/app.manifest that looks like:		* A manifest can list an explicit entry that is not same-origin with the application. Say we have a manifest at http://application.com/app.manifest that looks like:

DCamp: /* Data */

2008-09-08T18:01:31Z

Data

← Older revision		Revision as of 18:01, 8 September 2008
Line 51:		Line 51:

	== Data ==		== Data ==
	* What data is read or parsed by this feature
	* What is the output of this feature
	* What storage formats are used		* What storage formats are used
			As before, index information for the offline cache is stored in sqlite, actual cache entries are stored in files on disk. localStorage is stored in a sqlite database alongside globalStorage information.

	== Reliability ==		== Reliability ==

DCamp: /* Exported APIs */

2008-09-08T17:59:46Z

Exported APIs

← Older revision		Revision as of 17:59, 8 September 2008
Line 42:		Line 42:
	== Exported APIs ==		== Exported APIs ==
	* Please provide a table of exported interfaces (APIs, ABIs, protocols, UI, etc.)		* Please provide a table of exported interfaces (APIs, ABIs, protocols, UI, etc.)
	**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCache.idl nsIApplicationCache]] - Access to a single version of an application cache.		**[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCache.idl nsIApplicationCache] - Access to a single version of an application cache.
	**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheService.idl nsIApplicationCacheService]] - Access to the set of application caches.		**[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheService.idl nsIApplicationCacheService] - Access to the set of application caches.
	**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheContainer.idl nsIApplicationCacheContainer]] - Implemented by objects (channels and documents, currently) that can be associated with an application cache.		**[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheContainer.idl nsIApplicationCacheContainer] - Implemented by objects (channels and documents, currently) that can be associated with an application cache.
	** Manifest file, format documented in [[http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html#offline the spec]].		** Manifest file, format documented in [http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html#offline the spec].

	== Module interactions ==		== Module interactions ==

DCamp: /* Exported APIs */

2008-09-08T17:59:17Z

Exported APIs

← Older revision		Revision as of 17:59, 8 September 2008
Line 45:		Line 45:
	**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheService.idl nsIApplicationCacheService]] - Access to the set of application caches.		**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheService.idl nsIApplicationCacheService]] - Access to the set of application caches.
	**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheContainer.idl nsIApplicationCacheContainer]] - Implemented by objects (channels and documents, currently) that can be associated with an application cache.		**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheContainer.idl nsIApplicationCacheContainer]] - Implemented by objects (channels and documents, currently) that can be associated with an application cache.
	** Manifest file, format documented in [[~~the spec\|~~http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html#offline]].		** Manifest file, format documented in [[http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html#offline the spec]].

	== Module interactions ==		== Module interactions ==

DCamp: /* Exported APIs */

2008-09-08T17:59:00Z

Exported APIs

← Older revision		Revision as of 17:59, 8 September 2008
Line 42:		Line 42:
	== Exported APIs ==		== Exported APIs ==
	* Please provide a table of exported interfaces (APIs, ABIs, protocols, UI, etc.)		* Please provide a table of exported interfaces (APIs, ABIs, protocols, UI, etc.)
			**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCache.idl nsIApplicationCache]] - Access to a single version of an application cache.
	**[[~~nsIApplicationCache\|~~http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCache.idl]] - Access to a single version of an application cache.		**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheService.idl nsIApplicationCacheService]] - Access to the set of application caches.
	**[[~~nsIApplicationCacheService\|~~http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheService.idl]] - Access to the set of application caches.		**[[http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheContainer.idl nsIApplicationCacheContainer]] - Implemented by objects (channels and documents, currently) that can be associated with an application cache.
	**[[~~nsIApplicationCacheContainer\|~~http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheContainer.idl]] - Implemented by objects (channels and documents, currently) that can be associated with an application cache.
	** Manifest file, format documented in [[the spec\|http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html#offline]].		** Manifest file, format documented in [[the spec\|http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html#offline]].

DCamp: /* Exported APIs */

2008-09-08T17:57:44Z

Exported APIs

← Older revision		Revision as of 17:57, 8 September 2008
Line 42:		Line 42:
	== Exported APIs ==		== Exported APIs ==
	* Please provide a table of exported interfaces (APIs, ABIs, protocols, UI, etc.)		* Please provide a table of exported interfaces (APIs, ABIs, protocols, UI, etc.)
	* ~~Does it interoperate with~~ a ~~web service? How will it do so?~~
	* ~~Explain~~ the ~~significant file formats~~, ~~names, syntax, and semantics~~.		**[[nsIApplicationCache\|http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCache.idl]] - Access to a single version of an application cache.
	* ~~Are~~ the ~~externally visible interfaces documented clearly enough for a non~~-~~Mozilla developer to use them successfully?~~		**[[nsIApplicationCacheService\|http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheService.idl]] - Access to the set of application caches.
	* Does it change any existing interfaces?		**[[nsIApplicationCacheContainer\|http://hg.mozilla.org/mozilla-central/log/tip/netwerk/base/public/nsIApplicationCacheContainer.idl]] - Implemented by objects (channels and documents, currently) that can be associated with an application cache.
			** Manifest file, format documented in [[the spec\|http://www.whatwg.org/specs/web-apps/current-work/multipage/offline.html#offline]].

	== Module interactions ==		== Module interactions ==