Closed
Bug 1235661
Opened 9 years ago
Closed 9 years ago
sync services needs to use origin attributes correctly
Categories
(Firefox :: Security, defect)
Firefox
Security
Tracking
()
RESOLVED
WONTFIX
People
(Reporter: huseby, Assigned: baku)
References
Details
(Whiteboard: [OA])
Attachments
(1 file, 4 obsolete files)
(deleted),
patch
|
sicking
:
review-
|
Details | Diff | Splinter Review |
in the file dom/requestsync/RequestSyncService.jsm there is a call to createCodebasePrincipalFromOrigin that is used to remove the tasks associated with an app:
> 172 clearData: function(aData) {
> 173 debug('clearData');
> 174
> 175 if (!aData) {
> 176 return;
> 177 }
> 178
> 179 let pattern = JSON.parse(aData);
> 180 let dbKeys = [];
> 181
> 182 for (let key in this._registrations) {
> 183 let prin = Services.scriptSecurityManager.createCodebasePrincipalFromOrigin(key);
> 184 if (!ChromeUtils.originAttributesMatchPattern(prin.originAttributes, pattern)) {
> 185 continue;
> 186 }
I'm pretty sure the solution is to populate an origin attribute from the key, then create a GlobalContextOriginAttribute from that to force the user context id to 0 and then call createCodebasePrincipal with the origin attributes instead.
Reporter | ||
Comment 1•9 years ago
|
||
Tanvi,
I'm not entire sure what the solution is here. If you look at the code, the comment for the clearData function is: // When an app is uninstalled, we have to clean all its tasks. This suggests to me this is for offline apps. What do you think? If it's for offline apps, I think the correct solution here is to make sure the origin attributes have the user context id set to 0.
--dave
Flags: needinfo?(tanvi)
Comment 2•9 years ago
|
||
(In reply to Dave Huseby [:huseby] from comment #1)
> Tanvi,
>
> I'm not entire sure what the solution is here. If you look at the code, the
> comment for the clearData function is: // When an app is uninstalled, we
> have to clean all its tasks. This suggests to me this is for offline apps.
> What do you think? If it's for offline apps, I think the correct solution
> here is to make sure the origin attributes have the user context id set to 0.
>
> --dave
What is an "app" in this case? A firefoxOS app or something else? firefoxOS apps are likely all using a usercontext of 0. So it shouldn't make a difference if we keep the current origin attributes or force usercontext to 0.
If "app" is something Desktop related, we have to learn what it is before we can decide how to treat usercontext. Maybe needinfo someone who has touched this part of the code?
Flags: needinfo?(tanvi)
Assignee | ||
Comment 3•9 years ago
|
||
I wrote this API. This API is exposed just to b2g apps.
Attachment #8704114 -
Flags: review?(huseby)
Reporter | ||
Comment 4•9 years ago
|
||
Comment on attachment 8704114 [details] [diff] [review]
testA.patch
Review of attachment 8704114 [details] [diff] [review]:
-----------------------------------------------------------------
createGlobalContextOriginAttributes -> createDefaultContextOriginAttributes
Attachment #8704114 -
Flags: review?(huseby) → review-
Assignee | ||
Comment 5•9 years ago
|
||
Attachment #8704114 -
Attachment is obsolete: true
Attachment #8704567 -
Flags: review?(huseby)
Assignee | ||
Updated•9 years ago
|
Reporter | ||
Updated•9 years ago
|
Attachment #8704567 -
Flags: review?(huseby) → review+
Assignee | ||
Updated•9 years ago
|
Assignee: huseby → amarchesini
Reporter | ||
Comment 6•9 years ago
|
||
This patch ensures that the origin attributes from the key (origin) is used when doing the origin attributes pattern match.
Attachment #8704567 -
Attachment is obsolete: true
Attachment #8734986 -
Flags: review?(jonas)
Reporter | ||
Comment 7•9 years ago
|
||
Reporter | ||
Comment 8•9 years ago
|
||
this builds origin attributes from the key (origin), forces the user context id to 0, then uses the attributes for the pattern match.
Attachment #8734986 -
Attachment is obsolete: true
Attachment #8734986 -
Flags: review?(jonas)
Attachment #8734987 -
Flags: review?(jonas)
Reporter | ||
Comment 9•9 years ago
|
||
Reporter | ||
Comment 10•9 years ago
|
||
updated patch to have a better commit message.
Attachment #8734987 -
Attachment is obsolete: true
Attachment #8734987 -
Flags: review?(jonas)
Attachment #8735171 -
Flags: review?(jonas)
Comment on attachment 8735171 [details] [diff] [review]
Bug_1235661.patch
Review of attachment 8735171 [details] [diff] [review]:
-----------------------------------------------------------------
This looks wrong. The code seems fine as-is. RequestSync registrations are similar to service-worker registrations and indexedDB. We want that to be separated per-context.
Attachment #8735171 -
Flags: review?(jonas) → review-
Reporter | ||
Comment 12•9 years ago
|
||
per jonas' feedback, this patch is no longer needed.
Status: ASSIGNED → RESOLVED
Closed: 9 years ago
Resolution: --- → WONTFIX
Reporter | ||
Updated•9 years ago
|
Whiteboard: [OA]
You need to log in
before you can comment on or make changes to this bug.
Description
•