WebAPI/Security/TCPSocket: Difference between revisions

Revision as of 12:26, 24 September 2012

Brief purpose of API: Grant full access to raw sockets to allow applications such as SMTP clients etc

General Use Cases: None

Inherent threats: Malicious apps attacking internal systems (firewall bypass), local device access

Threat severity: High

Reference

Type	Use Cases	Authorization Model	Notes & Other Controls
Web Content	None	No access
Installed Web Apps	None	No access
Privileged Web Apps	Talk to non-HTTP services. SSH, FTP, mail clients, supporting custom protocols	Implicit	Firewall should prohibit access to privileged low number OS ports (<1024). Listening on a port < 1024 should be prohibited. Specify hosts/ports in the manifest, permissions granted implicitly.
Certified Web Apps	Open a connection to any domain/port	Implicit	specify hosts/ports in the manifest, permissions granted implicitly and not able to be revoked (unless device is in developer mode)

@@ Line 1: / Line 1: @@
-Name of API: Socket API
+== Socket API ==
-Reference
-*https://bugzilla.mozilla.org/show_bug.cgi?id=733573
-*Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/Asm37KDoVB4/discussion
 Brief purpose of API: Grant full access to raw sockets to allow applications such as SMTP clients etc
@@ Line 12: / Line 8: @@
 Threat severity: High
+Reference
+*https://bugzilla.mozilla.org/show_bug.cgi?id=733573
+*Security discussion: https://groups.google.com/d/topic/mozilla.dev.webapps/Asm37KDoVB4/discussion
 === Permissions Table===