search

mozilla / newtab-dev

Repo following gecko-dev for newtab development. No longer maintained.
Other
18 stars 10 forks source link

Ensure data coming from the page is always a string #20

Closed marcoscaceres closed 9 years ago

marcoscaceres commented 9 years ago

@oyiptong, right now, the security violations are just silently swallowed by the program and re-routed to the error console. This makes it difficult to observe, and also to test, the violations (by design). I don't think we want to make it start throwing exceptions (because it's a message listener, hence there is nothing that can catch those exceptions in a useful way) or sending error messages back to the page.

So, not sure exactly what we want to test here, apart from the "right" behavior - which is currently what we test for. I.e., only legitimate messages get through... everything else would just time out and do nothing. Not sure how to test for that tho?

oyiptong commented 9 years ago

We want to test the right behavior. That's pretty much it.

It gives us a safeguard in case something else breaks.

oyiptong commented 9 years ago

Actually, the messaging may already be tested elsewhere, so tests in this branch may not be necessary.

When we test for say pins being sent to the privileged context, it will make use of this codepath

sarracini commented 9 years ago

r+

marcoscaceres commented 9 years ago

@oyiptong this one went missing?

oyiptong commented 9 years ago

Yes. It's my failt

oyiptong commented 9 years ago

Fault

marcoscaceres commented 9 years ago

If it was not you, it would have been me! :D

Sent from my iPhone

On Oct 7, 2015, at 8:14 PM, Olivier Yiptong notifications@github.com wrote:

Fault

— Reply to this email directly or view it on GitHub.

oyiptong commented 9 years ago

Let's get @emtwo to review then we land

oyiptong commented 9 years ago

We need to wait on @Mardak's review to land everything though