WebAPI/Security/ScreenOrientation: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 1: Line 1:
Name of API: Screen Orientation
== Screen Orientation ==
 
Brief purpose of API: Get notification when screen orientation changes as well as lock the screen orientation
 
General use case: Prevent screen orientation from changing when playing a game utilizing device motion.  Switch screen orientation when switching between different parts of an app (i.e. from playlist to video playback).  API wise, this means detecting orientation and setting/locking orientation.


References:  
References:  
Line 5: Line 9:
*{{bug|673922}}
*{{bug|673922}}
*Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/285ab0bebdad0b7d/9b7ba31dc934014f
*Security Discussion: https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/285ab0bebdad0b7d/9b7ba31dc934014f
Brief purpose of API: Get notification when screen orientation changes as well as lock the screen orientation


Inherent threats: minor information leakage (device orientation), minor user inconvenience (lock device orientation)
Inherent threats: minor information leakage (device orientation), minor user inconvenience (lock device orientation)
Line 12: Line 14:
Threat severity: Low per https://wiki.mozilla.org/Security_Severity_Ratings
Threat severity: Low per https://wiki.mozilla.org/Security_Severity_Ratings


== Regular web content (unauthenticated) ==
=== Permissions Table===
Use cases for unauthenticated code: Prevent screen orientation from changing when playing a game utilizing device motion.  Switch screen orientation when switching between different parts of an app (i.e. from playlist to video playback).  API wise, this means detecting orientation and setting/locking orientation.
 
Authorization model for normal content: Implicit for detecting orientation, implicit for locking/setting orientation in fullscreen only
 
Authorization model for installed content: Implicit for both
 
Potential mitigations: As mentioned, normal content can only set/lock orientation in fullscreen.  Only top-level content can set/lock.
 
== Privileged (approved by app store) ==
Use cases for privileged code: Same as unauthenticated
 
Authorization model: Implicit
 
Potential mitigations: None
 
== Certified (system-critical apps) ==
Use cases for certified code: Same as above
 
Authorization model: Same as above


Potential mitigations: None
{| border="1" class="wikitable"
! Type
! Use Cases
! Authorization Model
! Notes & Other Controls
|-
| Web Content || As per general case|| Implicit for detecting orientation, implicit for locking/setting orientation in fullscreen only ||  Normal content can only set/lock orientation in fullscreen.  Only top-level content can set/lock.
|-
| Installed Web Apps || As per general case || Implicit ||
|-
| Privileged Web Apps ||  As per general case  || Implicit ||
|-
| Certified Web Apps ||  As per general case || Implicit ||
|}

Revision as of 04:40, 24 September 2012

Screen Orientation

Brief purpose of API: Get notification when screen orientation changes as well as lock the screen orientation

General use case: Prevent screen orientation from changing when playing a game utilizing device motion. Switch screen orientation when switching between different parts of an app (i.e. from playlist to video playback). API wise, this means detecting orientation and setting/locking orientation.

References:

Inherent threats: minor information leakage (device orientation), minor user inconvenience (lock device orientation)

Threat severity: Low per https://wiki.mozilla.org/Security_Severity_Ratings

Permissions Table

Type Use Cases Authorization Model Notes & Other Controls
Web Content As per general case Implicit for detecting orientation, implicit for locking/setting orientation in fullscreen only Normal content can only set/lock orientation in fullscreen. Only top-level content can set/lock.
Installed Web Apps As per general case Implicit
Privileged Web Apps As per general case Implicit
Certified Web Apps As per general case Implicit
Retrieved from "https://wiki.allizom.org/index.php?title=WebAPI/Security/ScreenOrientation&oldid=472948"