38
edits
Security/Reviews/TBOpenSearch: Difference between revisions
→Conclusions / Action Items
(Created page with "Items to be reviewed: Thunderbird Open Search - https://wiki.mozilla.org/Privacy/Reviews/OpenSearch Agenda: == Introduce Feature == === Goal of Feature, what is trying to be a...") |
|||
| Line 37: | Line 37: | ||
** Whitelist is at https://github.com/mozilla/opensearch/blob/develop/src/content/opensearch.js#L250 | ** Whitelist is at https://github.com/mozilla/opensearch/blob/develop/src/content/opensearch.js#L250 | ||
* [squib] test if search results tab has access to window.opener (the privileged code) | * [squib] test if search results tab has access to window.opener (the privileged code) | ||
** The search results don't have access to window.opener (it's null) | |||
* [squib] test for redirect behavior... can we break the "whitelist of allowed in thunderbird" rule via HTTP redirect? | * [squib] test for redirect behavior... can we break the "whitelist of allowed in thunderbird" rule via HTTP redirect? | ||
** Redirects can break the whitelist, so we need to fix this; possibly check in onLocationChange, which gives us the final URL (can we cancel the load from there?) | |||
* [sid] brief privacy review | * [sid] brief privacy review | ||