WebAPI/Security/FMRadioAPI: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(Created page with "== FM Radio API== Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=749053 Brief purpose of API: FM radio feature. General Use Cases: Turn on/off the radio, change frequency, che...")
 
No edit summary
 
(6 intermediate revisions by 2 users not shown)
Line 1: Line 1:
== FM Radio API==
==WebFM API==
Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=749053
Brief purpose of API: FM radio feature.
Brief purpose of API: FM radio feature.
General Use Cases: Turn on/off the radio, change frequency, check status of various radio features
General Use Cases: Turn on/off the radio, change frequency, check status of various radio features
Inherent threats: annoyance, drain the battery
Inherent threats: annoyance, drain the battery
Threat severity: low
 
Threat severity: Low


General notes:  
General notes:  
*Multiple apps/pages can try to modify radio settings at the same time with the most recent action taking effect.
Multiple apps/pages can try to modify radio settings at the same time with the most recent action taking effect. Turning on the radio causes the audio stream to be played - there is no access to the stream data
*Turning on the radio causes the audio stream to be played - there is no access to the stream data
 
References:
*https://bugzilla.mozilla.org/show_bug.cgi?id=749053
*https://groups.google.com/d/topic/mozilla.dev.webapi/PraULCQntqA/discussion
=== Permissions Table===


=== Regular web content (unauthenticated) ===
{| border="1" class="wikitable"
*Use cases for unauthenticated code: radio app/web page
! Type
*Authorization model for normal content: explicit
! Use Cases
*Authorization model for installed content: implicit
! Authorization Model
*Potential mitigations: An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always resent the current frequency to some specified value
! Notes & Other Controls
|-
| Web Content || radio app/web page || Explicit ||  An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always reset the current frequency to some specified value
|-
| Installed Web Apps || radio app/web page || Implicit ||  An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always reset the current frequency to some specified value
|-
| Privileged Web Apps || radio app || Implicit ||
|-
| Certified Web Apps || radio app || Implicit || Same as for unauthenticated. Technically we wouldn't need to reset the frequency here, but seems nicer to keep things consistent.
|}


=== Trusted (authenticated by publisher) ===
__NOTOC__
*Use cases for certified code:  radio app
*Authorization model: Implicit
*Potential mitigations: Same as for unauthenticated.


=== Certified (vouched for by trusted 3rd party) ===
[[Category:Web APIs]]
*Use cases for certified code:  radio app
[[Category:Security]]
*Authorization model: Implicit
*Potential mitigations: Same as for unauthenticated. Technically we wouldn't need to resent the frequency here, but seems nicer to keep things consistent.

Latest revision as of 23:40, 1 October 2014

WebFM API

Brief purpose of API: FM radio feature.

General Use Cases: Turn on/off the radio, change frequency, check status of various radio features Inherent threats: annoyance, drain the battery

Threat severity: Low

General notes: Multiple apps/pages can try to modify radio settings at the same time with the most recent action taking effect. Turning on the radio causes the audio stream to be played - there is no access to the stream data

References:

Permissions Table

Type Use Cases Authorization Model Notes & Other Controls
Web Content radio app/web page Explicit An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always reset the current frequency to some specified value
Installed Web Apps radio app/web page Implicit An app or page can't access any of the radio API if another page/app is currently using it. Whenever a page/app uses the API for the first time since another page/app used it, always reset the current frequency to some specified value
Privileged Web Apps radio app Implicit
Certified Web Apps radio app Implicit Same as for unauthenticated. Technically we wouldn't need to reset the frequency here, but seems nicer to keep things consistent.
Retrieved from "https://wiki.mozilla.org/index.php?title=WebAPI/Security/FMRadioAPI&oldid=1021337"