Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
Received-SPF: pass (athena.apache.org: domain of bowserj@gmail.com designates
 209.85.220.173 as permitted sender)
MIME-Version: 1.0
Reply-To: bowserj@apache.org
In-Reply-To: <a4aa7b5f3a9ca26b94e5936b3dd36fc2.squirrel@webmail2.colokoe.net>
References: 
 <CAOBL_k5oqzLMCx5_X0p94uSfA1Jy=gUWr+_p4j-6m6ry0+33Mw@mail.gmail.com>
	<CAK_TSXJbjLPmh8SjhK2q=24VQ59ConxJzu8YyV_ZZN7RWO34mw@mail.gmail.com>
	<CAOBL_k70J6bZjUdZed3gTEejWsn-xbu-6JoD70njOhnJo9pwEA@mail.gmail.com>
	<CABiQX1VhTVJ0fJ+r01Ba0kXEk+nKhCNNbWKzmwLNQ00b4qLvMw@mail.gmail.com>
	<a4aa7b5f3a9ca26b94e5936b3dd36fc2.squirrel@webmail2.colokoe.net>
Date: Fri, 31 Jan 2014 10:32:02 -0800
Message-ID: 
 <CAOBL_k7dQ34kLFp5iAAy9car_vXay3OyK-bcvVF6fau=1qV0Cg@mail.gmail.com>
Subject: Re: [Android] SecureToken/NoFrak feature addition
From: Joe Bowser <bowserj@gmail.com>
To: dev <dev@cordova.apache.org>, mail@nazgul.nu
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Jan 31, 2014 at 8:57 AM, Bas Bosman <mail@nazgul.nu> wrote:
>
> LocalStorage leverages the browser's same origin policy to ensure that
> content from other origins cannot read the token and thus cannot access
> the bridge. If we use vanilla JS there is nothing stopping the malicious
> code from reading the random # itself before calling the bridge.
>

We're not using Vanilla JS.  Tokens have to be added for all
whitelisted domains natively.  This is done to solve the whole Chicken
and the Egg problem that we have with our config.xml.  The value
should exist when the browser gets access to the storage, and it has
to match what it is natively, which I believed is stored in memory, so
even if the value was added in Vanilla JS, it would be caught and set
as invalid.  I haven't tested that.