Paul Theriault [:pauljt] (no longer reading bugmail) Reporter
	Description • 10 years ago

I'm not sure when WifiDirect was enabled but there appears to be no permission checks on the system messages:

https://dxr.mozilla.org/mozilla-central/source/dom/messages/SystemMessagePermissionsChecker.jsm#127

Unless I'm mistaken, that means any app could listen for these system messages, which is probably a privacy issue? It is documented as requiring the "wifi-manage" permission, but this is not how it is implemented. Marking as secure just in case, but its publicly documented so not sure how useful that is.

If this is actually an oversight, then this is probably a blocking bug, so marking 2.2?

The sec-rating is a guess, im not sure of the actually implication here, it may not actually be too bad.

	[:fabrice] Fabrice Desré Assignee
	Comment 1 • 10 years ago

I think you're right, since we broadcast these system messages (see http://mxr.mozilla.org/mozilla-central/ident?i=PAIRING_REQUEST_SYS_MSG).

	Vincent Chang[:vchang][changyihsin]
	Comment 3 • 10 years ago

Comment on attachment 8572057 [details] [diff] [review]
wifi-p2p.patch

Review of attachment 8572057 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks for jumping to this.

	[:fabrice] Fabrice Desré Assignee
	Comment 4 • 10 years ago

https://hg.mozilla.org/integration/b2g-inbound/rev/07d9bcf2c1c1

	Ryan VanderMeulen [:RyanVM]
	Comment 5 • 10 years ago

https://hg.mozilla.org/mozilla-central/rev/07d9bcf2c1c1

	Ryan VanderMeulen [:RyanVM]
	Comment 6 • 10 years ago

Do we need to consider backporting this to any older releases?

	[:fabrice] Fabrice Desré Assignee
	Comment 7 • 10 years ago

(In reply to Ryan VanderMeulen [:RyanVM UTC-5] from comment #6)
> Do we need to consider backporting this to any older releases?

Would be good, yes. a=me for all branches down to 2.0

	Ryan VanderMeulen [:RyanVM]
	Comment 8 • 10 years ago

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/303a47b92ecd
https://hg.mozilla.org/releases/mozilla-b2g34_v2_1/rev/28ffee0d5b0c
https://hg.mozilla.org/releases/mozilla-b2g32_v2_0/rev/e89ba447d264

	Ryan VanderMeulen [:RyanVM]
	Comment 9 • 10 years ago

https://hg.mozilla.org/releases/mozilla-b2g34_v2_1s/rev/28ffee0d5b0c
https://hg.mozilla.org/releases/mozilla-b2g32_v2_0m/rev/e89ba447d264

	Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)
	Comment 10 • 10 years ago

CCing bkerensa since he is release managing for ESR and wasn't able to see this.

	[:fabrice] Fabrice Desré Assignee
	Comment 11 • 10 years ago

We don't ship that code in desktop builds.