3,860
edits
Security/B2G/Browser API: Difference between revisions
no edit summary
Ptheriault (talk | contribs) No edit summary |
No edit summary |
||
| (3 intermediate revisions by one other user not shown) | |||
| Line 7: | Line 7: | ||
|SecTrackerFSA=no | |SecTrackerFSA=no | ||
}} | }} | ||
[[Category: | [[Category:Web APIs]] | ||
This is a proposal for a Browser API and a new HTML element called "<browser>", which is similar to an iframe but allows the implementation of a fully featured web browser as a web app. As it currently stand, this is implemented as an attribute of the existing iframe tag (<iframe mozbrowser> however this may change eventually (bug | |||
===Background=== | ===Background=== | ||
Goals | Goals | ||
* Provide support so that a Browser can be implemented as a Web App | * Provide support so that a Browser can be implemented as a Web App | ||
* | * Makes the iframe appear like a top-level browser window to the embedded content | ||
* | * Provide an API for parent page to manipulate and listen for changes of the embedded content's state. | ||
Specification: | Specification: | ||
* https://wiki.mozilla.org/WebAPI/BrowserAPI | * https://wiki.mozilla.org/WebAPI/BrowserAPI | ||
| Line 18: | Line 22: | ||
* https://bugzilla.mozilla.org/show_bug.cgi?id=693515 | * https://bugzilla.mozilla.org/show_bug.cgi?id=693515 | ||
Pages: | Pages: | ||
* https://developer.mozilla.org/en-US/docs/DOM/Using_the_Browser_API | |||
Source: | Source: | ||
* http://mxr.mozilla.org/mozilla-central/source/dom/browser-element | |||
===Architecture=== | |||
At its core, the browser creates a special type of iframe | |||
===Data Flow Diagram=== | ===Data Flow Diagram=== | ||
===Answered Questions=== | ===Answered Questions=== | ||
===Open Questions=== | ===Open Questions=== | ||
| Line 43: | Line 55: | ||
** Modal dialogs in the browser frame must not block parent page | ** Modal dialogs in the browser frame must not block parent page | ||
*Untrusted web page content not segregated sufficiently from Web Apps* Shared resources between untrusted content (i.e. page loaded in the mozbrowser) and the installed apps | *Untrusted web page content not segregated sufficiently from Web Apps | ||
** Shared resources between untrusted content (i.e. page loaded in the mozbrowser) and the installed apps. Cookies? | |||
** Other Origin based resource access (local storage, Indexed DB) | ** Other Origin based resource access (local storage, Indexed DB) | ||
** DoS attacks against the phone (mitigated by seperate process, but what about spamming functions which result in IPDL messages back to the B2G process? Especially for messages that result in costly functions) | ** DoS attacks against the phone (mitigated by seperate process, but what about spamming functions which result in IPDL messages back to the B2G process? Especially for messages that result in costly functions) | ||