You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cordova.apache.org by Joe Bowser <bo...@gmail.com> on 2015/01/23 19:51:22 UTC
So...can we merge 4.0.x into master yet?
Hey
So, now that 3.7.0 is mostly out the door (dealing with npm stuff now), I
think we should talk about getting 4.0.x merged into master and out the
door.
I know there's that CookeManager thing that breaks the File Transfer plugin
that we have to deal with, and I'm wondering if we can actually get some
tests for that before we do the merge. I really want 4.0.x to be in
mainline and be our priority so that we can get it out by the end of
January.
Also, once we get 4.0.x, we need to talk about WebViews and how we deal
with the whole Jellybean fiasco, but I think we need to take one step at a
time and get 4.0.x out.
Thoughts?
Joe
Re: So...can we merge 4.0.x into master yet?
Posted by Ross Gerbasi <rg...@gmail.com>.
> That's correct. The thing is that this is trivially easy to do with
> Android code. If someone installs a Cordova app from a third-party
source,
> or even from an app store before the harmful app is taken down, they could
> be compromised.
This is a problem for sure, but also fair to say this could happen if a
user installed
a non-cordova app, that used a webview, from a third-party source or the
play store. I
think I understand your point here though that we are focusing on the
outlook people
have towards a cordova app being insecure.
> You'd think, but we've had this discussion before about NoFrak,
third-party
> ad code, and third-party cookies. The more we keep saying that this is
the
> case, and that people who create cordova apps would be stupid to trust
> third-party code, the more we have people do it. Now, I think there's a
> balance between the two viewpoints, and we have to fi
Well as nobel of a cause as this is if people wanna whitelist the world and
include code they haven't properly vetted there isn't much we can do about
that...
> I think this is more of a concern with corporate applications that are
> side-loaded than apps from the Play Store. Given that alone we should at
> least try and address it by releasing 4.0.x. That still doesn't address
> all the things, but it at least gives some options.
Apologies if I am missing something else but just to be sure. 4.0.x will
address
this problem by allowing people to choose the webview. Technically someone
could
still use the older one if they wanted to be lazy about it, but this would
allow the ability
to switch over to crosswalk as an option?
> I think this is more of a concern with corporate applications that are
> side-loaded than apps from the Play Store. Given that alone we should at
> least try and address it by releasing 4.0.x. That still doesn't address
> all the things, but it at least gives some options.
Again I would really hope that if your corporation has spent the money
getting
an application built it would simply be built with security in mind. I am
probably
being over optimistic about developers here but one would think allowing
any holes
for external code to get trigged for your internal corporate app is a big
no no...
-ross
Re: So...can we merge 4.0.x into master yet?
Posted by Joe Bowser <bo...@gmail.com>.
On Sun Jan 25 2015 at 8:34:22 AM Ross Gerbasi <rg...@gmail.com> wrote:
> If I am missing something please let me know but from what I can tell the
> exploit is triggered via some kind of harmful code being executed inside
> the webview. This could come from a button click, or link to some site, or
> maybe somehow someone spoofs a trusted source and actually delivers code
> from a bad source.
That's correct. The thing is that this is trivially easy to do with
Android code. If someone installs a Cordova app from a third-party source,
or even from an app store before the harmful app is taken down, they could
be compromised.
> Something like that. I would think most cordova
> applications are self contained sites. So all the requests end up pulling
> local html/js files from the device. Injecting some kind of bad code into
> the application isn't really an option here without some other kind of
> hackery.
You'd think, but we've had this discussion before about NoFrak, third-party
ad code, and third-party cookies. The more we keep saying that this is the
case, and that people who create cordova apps would be stupid to trust
third-party code, the more we have people do it. Now, I think there's a
balance between the two viewpoints, and we have to find it.
I think this is more of a concern with corporate applications that are
side-loaded than apps from the Play Store. Given that alone we should at
least try and address it by releasing 4.0.x. That still doesn't address
all the things, but it at least gives some options.
Re: So...can we merge 4.0.x into master yet?
Posted by Ross Gerbasi <rg...@gmail.com>.
Though it would be great if Google would/could patch all the WebViews on
the older phones, and people can argue all day about how poopy it is and
whatnot. I am curious how much the actual exploit harms a majority of
cordova apps.
If I am missing something please let me know but from what I can tell the
exploit is triggered via some kind of harmful code being executed inside
the webview. This could come from a button click, or link to some site, or
maybe somehow someone spoofs a trusted source and actually delivers code
from a bad source. Something like that. I would think most cordova
applications are self contained sites. So all the requests end up pulling
local html/js files from the device. Injecting some kind of bad code into
the application isn't really an option here without some other kind of
hackery.
So is it fair to say if your application is not linking html/javascript
related material there isn't much of a concern here? If you are linking
externally or maybe using the in app browser, it is potentially bad but
only if the site your linking to was compromised somehow. Which then makes
me wonder how the heck did the site get compromised...
Anyways I may be totally off here so if anyone is more educated in this
area please correct me.
thanks
-ross
On Sat, Jan 24, 2015 at 2:33 PM, Joe Bowser <bo...@gmail.com> wrote:
> More about WebKit and Jellybean not being updated. This is the same line
> we've been saying, but a lot of users have been completely disregarding.
> So, I don't know where we should go from here:
>
> https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF
>
> On Fri, Jan 23, 2015, 11:34 AM Joe Bowser <bo...@gmail.com> wrote:
>
> > Marcel posted it a few days ago. I haven't seen anything come out of it
> > yet, but this is a big deal.
> >
> >
> >
> https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no-longer-provides-patches-for-webview-jelly-bean-and-prior
> >
> > On Fri Jan 23 2015 at 11:32:48 AM Andrew Grieve <ag...@chromium.org>
> > wrote:
> >
> >> Not sure what the JB fiasco is, but merging SGTM. We can always work off
> >> of
> >> 3.7.x if we end up needing another 3.x release.
> >>
> >> On Fri, Jan 23, 2015 at 1:51 PM, Joe Bowser <bo...@gmail.com> wrote:
> >>
> >> > Hey
> >> >
> >> > So, now that 3.7.0 is mostly out the door (dealing with npm stuff
> now),
> >> I
> >> > think we should talk about getting 4.0.x merged into master and out
> the
> >> > door.
> >> >
> >> > I know there's that CookeManager thing that breaks the File Transfer
> >> plugin
> >> > that we have to deal with, and I'm wondering if we can actually get
> some
> >> > tests for that before we do the merge. I really want 4.0.x to be in
> >> > mainline and be our priority so that we can get it out by the end of
> >> > January.
> >> >
> >> > Also, once we get 4.0.x, we need to talk about WebViews and how we
> deal
> >> > with the whole Jellybean fiasco, but I think we need to take one step
> >> at a
> >> > time and get 4.0.x out.
> >> >
> >> > Thoughts?
> >> >
> >> > Joe
> >> >
> >>
> >
>
Re: So...can we merge 4.0.x into master yet?
Posted by Joe Bowser <bo...@gmail.com>.
Cool. I'll start the discuss thread.
On Wed Jan 28 2015 at 7:05:17 AM Andrew Grieve <ag...@chromium.org> wrote:
> Merged 4.0.x in.
>
> On Mon, Jan 26, 2015 at 2:27 PM, Joe Bowser <bo...@gmail.com> wrote:
>
> > Well, I think we NEED to support third-party WebViews as a first step.
> If
> > I don't hear any objections, I'm going to merge 4.0.x into master
> tomorrow,
> > and start a discuss thread for the 4.0.x release. I believe all we
> really
> > need to do right now is make sure that the CookieManager issues are
> > resolved (without a Factory please, we've gone 5 years without using that
> > Java anti-pattern).
> >
> > As for the WebView, I don't want to inherit one, but at the same time I
> > don't really want to rely on Intel and XWalk. This is definitely an
> > internal conversation that I'm sure is going on (or should be going on)
> at
> > all our workplaces right now, and I'd be interested in hearing what
> > people's thoughts are about having the "One true WebView".
> >
> > On Mon Jan 26 2015 at 11:22:45 AM Marcel Kinard <cm...@gmail.com>
> > wrote:
> >
> > > I just read Adrian Ludwig's post on Plus, I now feel worse about Jelly
> > > Bean users. On one hand, we could communicate all over about loading
> only
> > > trusted content into the webview, but I think that will be ignored by a
> > lot
> > > of devs. On the other hand, we could provide our own webview by default
> > for
> > > 4.0 and above. That would require we drop support for Gingerbread
> (which
> > > I'm not necessarily against), but also brings with it ownership of the
> > > webview and us delivering security patches for it. Or maybe by default
> > > prevent non-local content from being loaded into the webview. Sigh.
> > >
> > > > On Jan 24, 2015, at 3:33 PM, Joe Bowser <bo...@gmail.com> wrote:
> > > >
> > > > More about WebKit and Jellybean not being updated. This is the same
> > line
> > > > we've been saying, but a lot of users have been completely
> > disregarding.
> > > > So, I don't know where we should go from here:
> > > >
> > > > https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF
> > >
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
> > > For additional commands, e-mail: dev-help@cordova.apache.org
> > >
> > >
> >
>
Re: So...can we merge 4.0.x into master yet?
Posted by Andrew Grieve <ag...@chromium.org>.
Merged 4.0.x in.
On Mon, Jan 26, 2015 at 2:27 PM, Joe Bowser <bo...@gmail.com> wrote:
> Well, I think we NEED to support third-party WebViews as a first step. If
> I don't hear any objections, I'm going to merge 4.0.x into master tomorrow,
> and start a discuss thread for the 4.0.x release. I believe all we really
> need to do right now is make sure that the CookieManager issues are
> resolved (without a Factory please, we've gone 5 years without using that
> Java anti-pattern).
>
> As for the WebView, I don't want to inherit one, but at the same time I
> don't really want to rely on Intel and XWalk. This is definitely an
> internal conversation that I'm sure is going on (or should be going on) at
> all our workplaces right now, and I'd be interested in hearing what
> people's thoughts are about having the "One true WebView".
>
> On Mon Jan 26 2015 at 11:22:45 AM Marcel Kinard <cm...@gmail.com>
> wrote:
>
> > I just read Adrian Ludwig's post on Plus, I now feel worse about Jelly
> > Bean users. On one hand, we could communicate all over about loading only
> > trusted content into the webview, but I think that will be ignored by a
> lot
> > of devs. On the other hand, we could provide our own webview by default
> for
> > 4.0 and above. That would require we drop support for Gingerbread (which
> > I'm not necessarily against), but also brings with it ownership of the
> > webview and us delivering security patches for it. Or maybe by default
> > prevent non-local content from being loaded into the webview. Sigh.
> >
> > > On Jan 24, 2015, at 3:33 PM, Joe Bowser <bo...@gmail.com> wrote:
> > >
> > > More about WebKit and Jellybean not being updated. This is the same
> line
> > > we've been saying, but a lot of users have been completely
> disregarding.
> > > So, I don't know where we should go from here:
> > >
> > > https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
> > For additional commands, e-mail: dev-help@cordova.apache.org
> >
> >
>
Re: So...can we merge 4.0.x into master yet?
Posted by Joe Bowser <bo...@gmail.com>.
Well, I think we NEED to support third-party WebViews as a first step. If
I don't hear any objections, I'm going to merge 4.0.x into master tomorrow,
and start a discuss thread for the 4.0.x release. I believe all we really
need to do right now is make sure that the CookieManager issues are
resolved (without a Factory please, we've gone 5 years without using that
Java anti-pattern).
As for the WebView, I don't want to inherit one, but at the same time I
don't really want to rely on Intel and XWalk. This is definitely an
internal conversation that I'm sure is going on (or should be going on) at
all our workplaces right now, and I'd be interested in hearing what
people's thoughts are about having the "One true WebView".
On Mon Jan 26 2015 at 11:22:45 AM Marcel Kinard <cm...@gmail.com> wrote:
> I just read Adrian Ludwig's post on Plus, I now feel worse about Jelly
> Bean users. On one hand, we could communicate all over about loading only
> trusted content into the webview, but I think that will be ignored by a lot
> of devs. On the other hand, we could provide our own webview by default for
> 4.0 and above. That would require we drop support for Gingerbread (which
> I'm not necessarily against), but also brings with it ownership of the
> webview and us delivering security patches for it. Or maybe by default
> prevent non-local content from being loaded into the webview. Sigh.
>
> > On Jan 24, 2015, at 3:33 PM, Joe Bowser <bo...@gmail.com> wrote:
> >
> > More about WebKit and Jellybean not being updated. This is the same line
> > we've been saying, but a lot of users have been completely disregarding.
> > So, I don't know where we should go from here:
> >
> > https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
> For additional commands, e-mail: dev-help@cordova.apache.org
>
>
Re: So...can we merge 4.0.x into master yet?
Posted by Marcel Kinard <cm...@gmail.com>.
I just read Adrian Ludwig's post on Plus, I now feel worse about Jelly Bean users. On one hand, we could communicate all over about loading only trusted content into the webview, but I think that will be ignored by a lot of devs. On the other hand, we could provide our own webview by default for 4.0 and above. That would require we drop support for Gingerbread (which I'm not necessarily against), but also brings with it ownership of the webview and us delivering security patches for it. Or maybe by default prevent non-local content from being loaded into the webview. Sigh.
> On Jan 24, 2015, at 3:33 PM, Joe Bowser <bo...@gmail.com> wrote:
>
> More about WebKit and Jellybean not being updated. This is the same line
> we've been saying, but a lot of users have been completely disregarding.
> So, I don't know where we should go from here:
>
> https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@cordova.apache.org
For additional commands, e-mail: dev-help@cordova.apache.org
Re: So...can we merge 4.0.x into master yet?
Posted by Joe Bowser <bo...@gmail.com>.
More about WebKit and Jellybean not being updated. This is the same line
we've been saying, but a lot of users have been completely disregarding.
So, I don't know where we should go from here:
https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF
On Fri, Jan 23, 2015, 11:34 AM Joe Bowser <bo...@gmail.com> wrote:
> Marcel posted it a few days ago. I haven't seen anything come out of it
> yet, but this is a big deal.
>
>
> https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no-longer-provides-patches-for-webview-jelly-bean-and-prior
>
> On Fri Jan 23 2015 at 11:32:48 AM Andrew Grieve <ag...@chromium.org>
> wrote:
>
>> Not sure what the JB fiasco is, but merging SGTM. We can always work off
>> of
>> 3.7.x if we end up needing another 3.x release.
>>
>> On Fri, Jan 23, 2015 at 1:51 PM, Joe Bowser <bo...@gmail.com> wrote:
>>
>> > Hey
>> >
>> > So, now that 3.7.0 is mostly out the door (dealing with npm stuff now),
>> I
>> > think we should talk about getting 4.0.x merged into master and out the
>> > door.
>> >
>> > I know there's that CookeManager thing that breaks the File Transfer
>> plugin
>> > that we have to deal with, and I'm wondering if we can actually get some
>> > tests for that before we do the merge. I really want 4.0.x to be in
>> > mainline and be our priority so that we can get it out by the end of
>> > January.
>> >
>> > Also, once we get 4.0.x, we need to talk about WebViews and how we deal
>> > with the whole Jellybean fiasco, but I think we need to take one step
>> at a
>> > time and get 4.0.x out.
>> >
>> > Thoughts?
>> >
>> > Joe
>> >
>>
>
Re: So...can we merge 4.0.x into master yet?
Posted by Joe Bowser <bo...@gmail.com>.
Marcel posted it a few days ago. I haven't seen anything come out of it
yet, but this is a big deal.
https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no-longer-provides-patches-for-webview-jelly-bean-and-prior
On Fri Jan 23 2015 at 11:32:48 AM Andrew Grieve <ag...@chromium.org>
wrote:
> Not sure what the JB fiasco is, but merging SGTM. We can always work off of
> 3.7.x if we end up needing another 3.x release.
>
> On Fri, Jan 23, 2015 at 1:51 PM, Joe Bowser <bo...@gmail.com> wrote:
>
> > Hey
> >
> > So, now that 3.7.0 is mostly out the door (dealing with npm stuff now), I
> > think we should talk about getting 4.0.x merged into master and out the
> > door.
> >
> > I know there's that CookeManager thing that breaks the File Transfer
> plugin
> > that we have to deal with, and I'm wondering if we can actually get some
> > tests for that before we do the merge. I really want 4.0.x to be in
> > mainline and be our priority so that we can get it out by the end of
> > January.
> >
> > Also, once we get 4.0.x, we need to talk about WebViews and how we deal
> > with the whole Jellybean fiasco, but I think we need to take one step at
> a
> > time and get 4.0.x out.
> >
> > Thoughts?
> >
> > Joe
> >
>
Re: So...can we merge 4.0.x into master yet?
Posted by Andrew Grieve <ag...@chromium.org>.
Not sure what the JB fiasco is, but merging SGTM. We can always work off of
3.7.x if we end up needing another 3.x release.
On Fri, Jan 23, 2015 at 1:51 PM, Joe Bowser <bo...@gmail.com> wrote:
> Hey
>
> So, now that 3.7.0 is mostly out the door (dealing with npm stuff now), I
> think we should talk about getting 4.0.x merged into master and out the
> door.
>
> I know there's that CookeManager thing that breaks the File Transfer plugin
> that we have to deal with, and I'm wondering if we can actually get some
> tests for that before we do the merge. I really want 4.0.x to be in
> mainline and be our priority so that we can get it out by the end of
> January.
>
> Also, once we get 4.0.x, we need to talk about WebViews and how we deal
> with the whole Jellybean fiasco, but I think we need to take one step at a
> time and get 4.0.x out.
>
> Thoughts?
>
> Joe
>