Security/B2G/Browser API

Please use "Edit with form" above to edit this page.

Project Info

{{#set:Component=Browser API |Project=` |Milestone=` |Resource=` }}

Status:	OK
Securtiy Approved for Beta Launch?:	No
Data Flow Diagram:	`
Threat Model:	`
Bugs:	`
Security Review:	`
Final Security Approval:	no

{{#set:Sectrackerstatus=OK |Simpyn=No |DFD=` |TM=` |bugs=` |Secreview=` |SecTrackerFSA=no }} [Category:WebApi]]

Goals

Provide support so that a Browser can be implemented as a Web App
Implemented as new type of iframe which provides limited cross-origin access so that a page embedding this iframe can act like a web browser.
Being implemented with a minimal set of APIs to

Specification:

Bugs:

Pages: Source:

Will there be a separate cookie store for <iframe mozbrowser>, or will they be shared?

Threat vectors:

Untrusted content escaping the <iframe mozbrowser> element
- javascript references to items not inside the iframe
- attacking local web apps through shared resources (are there any?)
Normal Browser Security controls weakened or not present
- URL Bar behavior? (need to expose SSL information)
Frame related issues
- Must handle frame-busting code correctly
Untrusted web page content not segregated sufficiently from Web Apps* Shared resources between untrusted content (i.e. page loaded in the mozbrowser) and the installed apps
- Cookies?
- Other Origin based resource access (local storage, Indexed DB)
- Permissions (what prevents a page loaded at sms.gaiamobile.org from getting SMS permissions?)
Untrusted page might gain access to create an <iframe mozbrowser>
Access to the local device (this is probably a b2g wide question)
file:// etc
loopback address/network address?