Security/Reviews/ModuleLoader

From New wiki
Jump to navigation Jump to search
Please use "Edit with form" above to edit this page.

Item Reviewed

Module Loader
Target <bugzilla>

{ "id":"756491,743359" }

</bugzilla>

{{#set:SecReview name=Module Loader |SecReview target=<bugzilla> { "id":"756491,743359" } </bugzilla> }}

Introduce the Feature

Goal of Feature, what is trying to be achieved (problem solved, use cases, etc)

  • we are using a module loader that is similiar to what is used by Node.js
    • long term goal is to land SDK to Firefox
    • landing this first, then api then sdk
  • this would allow jetpack items to use the module loader (currently shipped with each add-on)
    • Loader instance won't be shared across add-on instances just a code to create loaders
    • Blacklists Components from sandboxes we create

https://bugzilla.mozilla.org/show_bug.cgi?id=747434

    • We will be able to visualize capabilities graph for add-on reviewers like this:

http://bl.ocks.org/2582184

What solutions/approaches were considered other than the proposed solution?

  • keep it as is

Why was this solution chosen?

  • better for performance and smaller add-ons

Any security threats already considered in the design and why?

  • uses SubscriptLoader() so remote modules will not be loaded.

Threat Brainstorming

' {{#set: SecReview feature goal=* we are using a module loader that is similiar to what is used by Node.js

    • long term goal is to land SDK to Firefox
    • landing this first, then api then sdk
  • this would allow jetpack items to use the module loader (currently shipped with each add-on)
    • Loader instance won't be shared across add-on instances just a code to create loaders
    • Blacklists Components from sandboxes we create

https://bugzilla.mozilla.org/show_bug.cgi?id=747434

    • We will be able to visualize capabilities graph for add-on reviewers like this:

http://bl.ocks.org/2582184 |SecReview alt solutions=* keep it as is |SecReview solution chosen=* better for performance and smaller add-ons |SecReview threats considered=* uses SubscriptLoader() so remote modules will not be loaded. |SecReview threat brainstorming=' }}

Action Items

Action Item Status None
Release Target `
Action Items
'

{{#set:|SecReview action item status=None

|Feature version=` |SecReview action items=` }}