Security/Reviews/PluginOverlayAPI - Revision history

Jetvillegas at 00:50, 4 August 2012

2012-08-04T00:50:25Z

← Older revision		Revision as of 00:50, 4 August 2012
Line 58:		Line 58:
	<td>Arrange secreview for shumway</td>		<td>Arrange secreview for shumway</td>
	<td>Coincide with / follow shortly "rough alpha" ( suggest making secreview bug now, updating with time as appropriate)</td>		<td>Coincide with / follow shortly "rough alpha" ( suggest making secreview bug now, updating with time as appropriate)</td>
	<td></td>		<td>{{done\|:}} {{bug\|780311}}</td>
	</tr>		</tr>

Abillings at 22:15, 3 August 2012

2012-08-03T22:15:56Z

Abillings at 22:14, 3 August 2012

2012-08-03T22:14:49Z

← Older revision		Revision as of 22:14, 3 August 2012
Line 25:		Line 25:
	(iframe box testing http://pastebin.mozilla.org/1735309 )		(iframe box testing http://pastebin.mozilla.org/1735309 )
	\|SecReview alt solutions=Alternative solution: to provide an API to the extension that will fully intercept a flash object instantiation we need:		\|SecReview alt solutions=Alternative solution: to provide an API to the extension that will fully intercept a flash object instantiation we need:
	1. add entries to the window.navigator.plugins (with the same		# add entries to the window.navigator.plugins (with the same name, descript, version and mime type as flash);
	name, descript, version and mime type as flash);		# intercept/forward all <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"> instantiations;
	2. intercept/forward all <object		# and, suppress the plugins priority for the document loader factory.
	classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000">
	instantiations;
	3. and, suppress the plugins priority for the document loader
	factory.
	\|SecReview solution chosen=Less intervention into existing plugin loading base (nsObjectLoadingContent)		\|SecReview solution chosen=Less intervention into existing plugin loading base (nsObjectLoadingContent)
	\|SecReview threat brainstorming=* iframe created for preview loads data: URI - inherits principal of resource:// URI which has some level of privilege - could try and use a null principal or iframe sandbox when it lands ?		\|SecReview threat brainstorming=* iframe created for preview loads data: URI - inherits principal of resource:// URI which has some level of privilege - could try and use a null principal or iframe sandbox when it lands ?
	* preview iframe might be able to somehow interact with page/DOM after the user has decided to load the actual plugin if it's not cleaned up		* preview iframe might be able to somehow interact with page/DOM after the user has decided to load the actual plugin if it's not cleaned up
	}}		}}
	{{SecReviewActionStatus		{{SecReviewActionStatus

Abillings at 22:12, 3 August 2012

2012-08-03T22:12:16Z

@@ Line 11: / Line 11: @@
 </bugzilla>
 }}
-{{SecReview}}
+{{SecReview
 {{SecReviewActionStatus
 |SecReview action item status=In Progress
@@ Line 27: / Line 51: @@
 </tr>
 <tr>
 	<td></td>
 </tr>
 </table>

Abillings at 17:41, 31 July 2012

2012-07-31T17:41:23Z

← Older revision		Revision as of 17:41, 31 July 2012
Line 11:		Line 11:
	</bugzilla>		</bugzilla>
	}}		}}
	{{SecReview		{{SecReview}}
	\|SecReview feature goal=*
	\|SecReview alt solutions=*
	\|SecReview solution chosen=*
	\|SecReview threats considered=*
	\|SecReview threat brainstorming=*
	}}
	{{SecReviewActionStatus		{{SecReviewActionStatus
	\|SecReview action item status=In Progress		\|SecReview action item status=In Progress

Abillings: Created page with "{{SecReviewInfo |SecReview name=Plugin Overlay API |SecReview target=* http://mozilla.github.com/shumway/ * Source: http://mozilla.github.com/shumway/ * API docs: https://bugzill..."

2012-07-31T17:39:06Z

Created page with "{{SecReviewInfo |SecReview name=Plugin Overlay API |SecReview target=* http://mozilla.github.com/shumway/ * Source: http://mozilla.github.com/shumway/ * API docs: https://bugzill..."

New page

{{SecReviewInfo
|SecReview name=Plugin Overlay API
|SecReview target=* http://mozilla.github.com/shumway/
* Source: http://mozilla.github.com/shumway/
* API docs: https://bugzilla.mozilla.org/attachment.cgi?id=647141
Review Bug:
<bugzilla>
{
"id":"776208"
}
</bugzilla>
}}
{{SecReview
|SecReview feature goal=*
|SecReview alt solutions=*
|SecReview solution chosen=*
|SecReview threats considered=*
|SecReview threat brainstorming=*
}}
{{SecReviewActionStatus
|SecReview action item status=In Progress
|SecReview action items=<table border="1">
<tr>
<td>Who</td>
<td>bug</td>
<td>Action</td>
<td>By When</td>
<td>Completed date
{{new|new}}
{{done|Done}}
{{miss|Miss}}
</td>
</tr>
<tr>
<td></td>
<td> </td>
<td> </td>
<td> </td>
<td> </td>
</tr>

</table>
<bugzilla>
{
"id":""
}
</bugzilla>
}}

← Older revision		Revision as of 22:15, 3 August 2012
Line 13:		Line 13:
	{{SecReview		{{SecReview
	\|SecReview feature goal=To provide the API for the JavaScript extension to create the preview of a plug-in for specific mime type. Typical use case is to allow creation of the firefox extensions to provide the secure and interactive preview for or fully replace the native plugins.		\|SecReview feature goal=To provide the API for the JavaScript extension to create the preview of a plug-in for specific mime type. Typical use case is to allow creation of the firefox extensions to provide the secure and interactive preview for or fully replace the native plugins.

	This is a key component of the Shumway implementation of a web-native SWF runtime, specifically the browser integration with Firefox		This is a key component of the Shumway implementation of a web-native SWF runtime, specifically the browser integration with Firefox

	=== Notes ===		=== Notes ===
	Shumway will call registerPlayPreviewMimeType		Shumway will call registerPlayPreviewMimeType

	When there's an embed, a check for whether there's a preview for the type (if not, it calls up plugin) if there is, it loads shumway (other preview) instead.		When there's an embed, a check for whether there's a preview for the type (if not, it calls up plugin) if there is, it loads shumway (other preview) instead.
	How does the extension distinguish between multiple frames with the same source? - shumway has access the DOM tree and can extract the information from the original element.		How does the extension distinguish between multiple frames with the same source? - shumway has access the DOM tree and can extract the information from the original element.

	What is the origin of the document in the iframe - originally the data: uri, then changed by the streamconverter - (for shumway, looks like resource:)		What is the origin of the document in the iframe - originally the data: uri, then changed by the streamconverter - (for shumway, looks like resource:)
	use of a resource URL is likely to cause problems - either use a null principal or use the origin of the original resource.		use of a resource URL is likely to cause problems - either use a null principal or use the origin of the original resource.

	This isn't enabling anything addons can't already do; rather, exposing a cleaner way for them to do something.		This isn't enabling anything addons can't already do; rather, exposing a cleaner way for them to do something.
	~~(pilot shumway extension~~ https://github.com/mozilla/shumway/tree/master/extension/firefox)
	~~(iframe box testing~~ http://pastebin.mozilla.org/1735309 )		[https://github.com/mozilla/shumway/tree/master/extension/firefox pilot shumway extension]

			[http://pastebin.mozilla.org/1735309 iframe box testing]
	\|SecReview alt solutions=Alternative solution: to provide an API to the extension that will fully intercept a flash object instantiation we need:		\|SecReview alt solutions=Alternative solution: to provide an API to the extension that will fully intercept a flash object instantiation we need:

	# add entries to the window.navigator.plugins (with the same name, descript, version and mime type as flash);		# add entries to the window.navigator.plugins (with the same name, descript, version and mime type as flash);
	# intercept/forward all <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"> instantiations;		# intercept/forward all <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000"> instantiations;