Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
Received-SPF: pass (athena.apache.org: domain of iclelland@google.com
 designates 209.85.219.45 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAESi+48tsNoR8cogNCC5FDOdTJkiQMP2FT-kFo9DpY_Q6f3w=Q@mail.gmail.com>
References: <180579694.19640458.1371728791131.JavaMail.root@mozilla.com>
 <2080113123.19641545.1371730014649.JavaMail.root@mozilla.com>
 <CADVgkyMY5sWK4_zYjtbh+2wvdEpQEy_dOJQVif_ehJrJXRodXw@mail.gmail.com>
 <CAESi+48tsNoR8cogNCC5FDOdTJkiQMP2FT-kFo9DpY_Q6f3w=Q@mail.gmail.com>
From: Ian Clelland <iclelland@google.com>
Date: Mon, 24 Jun 2013 14:50:24 -0400
Message-ID: 
 <CAK_TSXJLNYzDVU7oSckOoyjHx3FKbyEhDL_dOaWSiifMmCCXWw@mail.gmail.com>
Subject: Re: Security Error in FirefoxOS on reading window.navigator
 properties
To: "dev@cordova.apache.org" <dev@cordova.apache.org>
Content-Type: multipart/alternative; boundary=001a11c339d2d6384304dfeae3e5

--001a11c339d2d6384304dfeae3e5
Content-Type: text/plain; charset=UTF-8

Can the SecurityError be caught in an try{} block? If so, then we could
implement a general solution of "try to clobber the entire object; if that
doesn't work, try to clobber each of its properties instead."

In the second case, a debug log line for each property that cannot be
copied would give us a list of any platform-dependent quirks that we need
to document.


On Mon, Jun 24, 2013 at 2:42 PM, Gord Tanner <gtanner@gmail.com> wrote:

> This is from the bootstrap file for all platforms [1].
>
> This is to cover us for security issues we were having on other platforms
> where we are not able to replace existing navigator object methods
> (geolocation, etc) or add new ones.  We create this object and proxy to the
> original navigator object to have something that is a bit more flexible for
> us to work with and modify.
>
> Does firefox yell at us if we replace the navigator object without
> iterating over the old one? We could then just hardcode the list of
> functions to proxy over to the original for that platform.
>
> [1] -
>
> https://git-wip-us.apache.org/repos/asf?p=cordova-js.git;a=blob_plain;f=lib/scripts/bootstrap.js;hb=HEAD
>
>
> On Mon, Jun 24, 2013 at 2:34 PM, Brian LeRoux <b@brian.io> wrote:
>
> > I'm at a loss why that code even needs to exist.
> >
> > Anyone? Herm / Gord?
> >
> > On Thu, Jun 20, 2013 at 5:06 AM, Piotr Zalewa <pzalewa@mozilla.com>
> wrote:
> > > I came to a point where I need to use the group wisdom.
> > >
> > > In
> >
> https://github.com/apache/cordova-firefoxos/blob/master/lib/cordova.firefoxos.js#L5929Cordovais trying to replace window.navigator with something which looks
> > like a copy of itself. window.navigator is protected in FirefoxOS - even
> > browsing through its properties is not allowed.
> > >
> > > alert('pre'); for (var key in window.navigator)
> {window.navigator[key]};
> > alert('post');
> > >
> > > Above code will work in browser, but not on the device or Simulator. It
> > will throw "SecurityError: The operation is insecure." and 'post' will
> not
> > get alerted. Example in JSFiddle -
> > http://jsfiddle.net/zalun/VkCyH/embedded/result/ (just install in
> > Simulator)
> > >
> > > I'm looking for a solution for that issue.
> > >
> > > Is the step with replacing window.navigator needed? The comment in the
> > code says
> > > // We replace it so that properties that can't be clobbered can instead
> > be overridden.
> > >
> > >
> > > Piotr
> >
>

--001a11c339d2d6384304dfeae3e5--