Security/Reviews/Gaia/Music - Revision history

Yyang: /* App Review Details */

2015-11-20T19:34:28Z

App Review Details

← Older revision		Revision as of 19:34, 20 November 2015
Line 3:		Line 3:
	* Review Date: 20 Nov 2015		* Review Date: 20 Nov 2015
	* Latest Commit: https://github.com/mozilla-b2g/gaia/commit/9563c38e0cd3fbaaec2a40cd525baf7df5098f2f		* Latest Commit: https://github.com/mozilla-b2g/gaia/commit/9563c38e0cd3fbaaec2a40cd525baf7df5098f2f
	* Review Lead: Yu Yang		* Review Lead: Yu Yang ( https://mozillians.org/en-US/u/yuyang753/ )

	=== Overview ===		=== Overview ===

2015-11-20T17:16:26Z

6. Interfaces with other Apps/Content

← Older revision		Revision as of 17:16, 20 November 2015
Line 123:		Line 123:

	====6. Interfaces with other Apps/Content====		====6. Interfaces with other Apps/Content====
			Only through Web Activities.


	=== Security Risks & Mitigating Controls ===		=== Security Risks & Mitigating Controls ===

2015-11-20T17:15:45Z

5. Use of Privileged APIs

← Older revision		Revision as of 17:15, 20 November 2015
Line 119:		Line 119:

	====5. Use of Privileged APIs ====		====5. Use of Privileged APIs ====
			* DeviceStorage - used to access the audio and picture files
			* Settings - used to read locale settings

	====6. Interfaces with other Apps/Content====		====6. Interfaces with other Apps/Content====

2015-11-20T17:15:06Z

4. Denial of Service

← Older revision		Revision as of 17:15, 20 November 2015
Line 114:		Line 114:

	====4. Denial of Service ====		====4. Denial of Service ====
			It might be possible to confuse the meta-data parser by storing a malformed or constructed audio file on the device. This could lead to the library failing to render or audio files missing. None of which is serious enough to consider.

			Since all file parsing is done in high level JavaScript, there is no way that the above attack could lead to a privilege escalation or code execution attack.

	====5. Use of Privileged APIs ====		====5. Use of Privileged APIs ====

2015-11-20T17:14:11Z

3. Secure data storage

← Older revision		Revision as of 17:14, 20 November 2015
Line 111:		Line 111:

	====3. Secure data storage ====		====3. Secure data storage ====
			The musicdb API is implemented in /js/db.js and used to manage music files and metadata on the SD Card

	====4. Denial of Service ====		====4. Denial of Service ====

2015-11-20T17:13:36Z

2. Secure Communications

← Older revision		Revision as of 17:13, 20 November 2015
Line 108:		Line 108:

	====2. Secure Communications ====		====2. Secure Communications ====
			This app does not communicate with any external services.

	====3. Secure data storage ====		====3. Secure data storage ====

2015-11-20T17:13:14Z

1. XSS & HTML Injection attacks

← Older revision		Revision as of 17:13, 20 November 2015
Line 105:		Line 105:

	====1. XSS & HTML Injection attacks====		====1. XSS & HTML Injection attacks====
			No XSS or Injection attacks were found.

	====2. Secure Communications ====		====2. Secure Communications ====

2015-11-20T17:12:34Z

Notable Event Handlers

2015-11-20T17:12:06Z

Web Activity Usage

← Older revision		Revision as of 17:12, 20 November 2015
Line 95:		Line 95:
	====Web Activity Usage ====		====Web Activity Usage ====

			The following activities are initiated:

			* share (endpoint.js)

	==== Notable Event Handlers ====		==== Notable Event Handlers ====

2015-11-20T17:11:16Z

Web Activity Handlers

← Older revision		Revision as of 17:11, 20 November 2015
Line 88:		Line 88:
	====Web Activity Handlers ====		====Web Activity Handlers ====

			Support two activities: open (audio) and pick (audio)

			* Open – Open an audio file
			* Pick – Pick a song and return its playback status like title, artist, album.

	====Web Activity Usage ====		====Web Activity Usage ====