Security/Reviews/Gaia/bluetooth: Difference between revisions

From MozillaWiki
< Security‎ | Reviews‎ | Gaia
Jump to navigation Jump to search
No edit summary
Line 18: Line 18:


====Permissions====
====Permissions====
The bluetooth app has the following permissions:
<code>
"permissions": {
    "bluetooth":{},
    "device-storage:sdcard":{ "access": "readonly" },
    "settings":{ "access": "readwrite" }
  }
</code>
* Bluetooth is need to send files via bluetooth.
* device-storage is used to monitor remaining disk space
* settings access is needed to monitor and change the "bluetooth.enabled" setting.


====Web Activity Handlers ====
====Web Activity Handlers ====
====Web Activity Usage ====
The bluetooth app accepts one web activity as described in its web app manifest:
The bluetooth app accepts one web activity as described in its web app manifest:


Line 37: Line 45:
   }
   }
</code>
</code>
====Web Activity Usage ====


==== Notable Event Handlers ====
==== Notable Event Handlers ====

Revision as of 05:40, 5 March 2013

App Review Details

  • App: Bluetooth
  • Review Date: 5th March 2003
  • Review Lead: Paul Theriault

Overview

The bluetooth app is a small app which is only used to facilitate transfer of files via bluetooth. It does not have an icon on the homescreen, rather it is triggered by an app launching a web activity.

Architecture

Components

The bluetooth app consists of one HTML page which is designed to accept web activity share requests.

Relevant Source Code

Permissions

The bluetooth app has the following permissions:

"permissions": {
   "bluetooth":{},
   "device-storage:sdcard":{ "access": "readonly" },
   "settings":{ "access": "readwrite" }
 }

  • Bluetooth is need to send files via bluetooth.
  • device-storage is used to monitor remaining disk space
  • settings access is needed to monitor and change the "bluetooth.enabled" setting.

Web Activity Handlers

The bluetooth app accepts one web activity as described in its web app manifest:

"activities": {

   "share": {
     "filters": {
     	"number": 1
      },
     "disposition": "inline",
     "returnValue": true,
     "href": "/transfer.html"
   }   
 }

Web Activity Usage

Notable Event Handlers

Code Review Notes

1. XSS & HTML Injection attacks

2. Secure Communications

3. Secure data storage

4. Denial of Service

5. Use of Privileged APIs

6. Interfaces with other Apps/Content

Security Risks & Mitigating Controls

Actions & Recommendations