Firefox 3.6/Personas Uplift Security Review

Overview

Describe the goals and objectives of the feature here.

What potential security issues in your feature have you already considered and addressed?
- we don't verify that the files stored as profile-folder/lightweighttheme-header and profile-folder/lightweighttheme-footer are in fact images.
Include a thorough description of the security assumptions, capabilities and any potential risks (possible attack points) being introduced by your project.

Please provide a table of exported interfaces (APIs, ABIs, protocols, UI, etc.)
Does it interoperate with a web service? How will it do so?
Explain the significant file formats, names, syntax, and semantics.
Are the externally visible interfaces documented clearly enough for a non-Mozilla developer to use them successfully?
Does it change any existing interfaces?
- no

What data is read or parsed by this feature?
- the data-browsertheme attribute is read from content and parsed using JSON.parse
What is the output of this feature?
What storage formats are used?
- prefs and profile-folder/lightweighttheme-header, profile-folder/lightweighttheme-footer

What failure modes or decision points are presented to the user?
- When the InstallBrowserTheme event is dispatched on a content node, a notification bar appears, saying that this site (the location.host of the node's ownerDocument) attempted to install a theme. There's an "Allow" button. Not approved for 1.9.2 yet: When a theme has been installed, another notifcation bar confirms that a theme has been installed, allowing the user to undo this or open the add-ons manager's themes pane.
Can its files be corrupted by failures? Does it clean up any locks/files after crashes?

Can the end user configure settings, via a UI or about:config? Hidden prefs? Environment variables?
Are there build options for developers? [#ifdefs, ac_add_options, etc.]
What ranges for the tunable are appropriate? How are they determined?
What are its on-going maintenance requirements (e.g. Web links, perishable data files)?

Are there related projects in the community?

If so, what is the proposal's relationship to their work? Do you depend on others' work, or vice-versa?
Are you updating, copying or changing functional areas maintained by other groups? How are you coordinating and communicating with them? Do they "approve" of what you propose?