canmove, Confirmed users
1,220
edits
Security/Reviews/Gaia/costcontrol: Difference between revisions
Jump to navigation
Jump to search
Security/Reviews/Gaia/costcontrol (view source)
Revision as of 22:01, 30 September 2013
, 30 September 2013→Security Risks & Mitigating Controls
Ptheriault (talk | contribs) |
|||
| Line 118: | Line 118: | ||
=== Security Risks & Mitigating Controls === | === Security Risks & Mitigating Controls === | ||
* Extraneous certified permissions in manifest. | * Extraneous certified permissions in manifest. | ||
* After speaking with developer regarding [https://wiki.mozilla.org/Security/Reviews/Gaia/costcontrol&section=20#Suspicious_but_OK suspected but ok] issues, specifically the dynamically creating <script> tags in view_manager.js, I've learned that in some instances developers depend on innerHTML quirks for "sanitization" purposes. | * After speaking with developer regarding [https://wiki.mozilla.org/Security/Reviews/Gaia/costcontrol&section=20#Suspicious_but_OK suspected but ok] issues, specifically the dynamically creating <script> tags in view_manager.js, I've learned that in some instances developers depend on innerHTML quirks for "sanitization" purposes. | ||
=== Actions & Recommendations === | === Actions & Recommendations === | ||