Security/Reviews/Gaia/Contacts/Import

< Security‎ | Reviews‎ | Gaia‎ | Contacts
Revision as of 16:32, 19 November 2013 by Arroway (talk | contribs) (Added architecture overview)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)


Feature Review Details

  • App: Contacts, which is part of the Communications application
  • Review Date: November 18th, 2013
  • Review Lead: Stéphanie Ouillon
  • Branch reviewed: master
  • Latest commit:

https://github.com/mozilla-b2g/gaia/commit/6b8572b10572059a359ff0fc68a0e0b83eda250b

Overview

This review focuses on one feature in particular of the Contacts app: importing and exporting contacts.

There several ways to in import/export contacts:

  • external services on the web such as Google, Live, Yahoo BT! and Facebook
  • SIM card or SD card
  • vCard via bluetooth

Architecture

This review goes through the Gaia Communications app, the Contacts API and the underlying code to communicate with the SIM/SD card. The code is split between several components of the Communications app:

  • contacts: oauth, Facebook integration, SIM/SD card, vCard
  • gmail: service extension for importing contacts
  • live: service extension for importing contacts
  • facebook: service extension for importing/synchronising contacts

The service extensions are registered in the contacts app.

Several APIs are used:

  • DeviceStorage: used to access the sdcard filesystem. Security review here.
  • MozIccManager: provides STK (SIM Application TooKit) functionalities
  • Bluetooth: allows to connect to a Bluetooth device to get a vCard. Security review here

 

Components

Relevant Documentation

webAPI: ContactsAPI - privileged

Gaia: app Contacts

Relevant Source Code

Code Review Notes

1. XSS & HTML Injection attacks

2. Secure Communications

3. Secure data storage

4. Denial of Service

5. Use of Privileged APIs

6. Interfaces with other Apps/Content

Security Risks & Mitigating Controls

Actions & Recommendations