content-hub

Merge lp://staging/~ken-vandine/content-hub/url-dispatcher into lp://staging/content-hub

url-dispatcher
Merge into trunk

Proposed by Ken VanDine on 2015-05-13

Status:	Merged
Approved by:	Michael Sheldon on 2015-05-18
Approved revision:	209
Merged at revision:	209
Proposed branch:	lp://staging/~ken-vandine/content-hub/url-dispatcher
Merge into:	lp://staging/content-hub
Diff against target:	401 lines (+343/-0) 9 files modified CMakeLists.txt (+1/-0) debian/content-hub.install (+3/-0) tools/CMakeLists.txt (+17/-0) tools/send/CMakeLists.txt (+59/-0) tools/send/autoexporter.cpp (+79/-0) tools/send/autoexporter.h (+50/-0) tools/send/content-hub-send.desktop (+9/-0) tools/send/content-hub-send.url-dispatcher (+5/-0) tools/send/exporter.cpp (+120/-0)
To merge this branch:	bzr merge lp://staging/~ken-vandine/content-hub/url-dispatcher
Related bugs:	Link a bug report

Reviewer	Review Type	Date Requested	Status
Michael Sheldon (community)		2015-05-13	Approve on 2015-05-18
PS Jenkins bot	continuous-integration		Approve on 2015-05-15
Review via email: mp+259039@code.staging.launchpad.net

Commit message

Added url-dispatcher integration. This allows export and share requests to be initiated by opening a url.

Description of the change

Added url-dispatcher integration. This allows export and share requests to be initiated by opening a url. For example, to create a share request to facebook you could open a url like:

"content:?pkg=com.ubuntu.developer.webapps.webapp-facebook&app=webapp-facebook&handler=share&url=http://www.ubuntu.com"

Parameters:
* pkg - click package name (required)
* app - click app name, ubuntu-app-launch will attempt to guess if not provided
* ver - version of the click package, defaults to "current-user-version"
* handler - export or share, defaults to defaults to "export"

A simple way to test this would be to run this from a shell:

url-dispatcher "content:?pkg=messaging-app&handler=share&url=http://www.ubuntu.com"

This will open the messaging-app and insert the link

File transfers are prohibited, for security reasons. So this only works for remote links and text shares.

lp://staging/~ken-vandine/content-hub/url-dispatcher updated on 2015-05-13

205. By Ken VanDine on 2015-05-13: tidy up a bit
206. By Ken VanDine on 2015-05-13: merged trunk

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2015-05-13:

PASSED: Continuous integration, rev:206
http://jenkins.qa.ubuntu.com/job/content-hub-ci/254/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-amd64-ci/50
    SUCCESS: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-armhf-ci/50
        deb: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-armhf-ci/50/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-i386-ci/50

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/content-hub-ci/254/rebuild

review: Approve (continuous-integration)

lp://staging/~ken-vandine/content-hub/url-dispatcher updated on 2015-05-14

207. By Ken VanDine on 2015-05-14: Cleaned up appId creation and all text to be set
208. By Ken VanDine on 2015-05-14: white space cleanup

Revision history for this message

PS Jenkins bot (ps-jenkins) wrote on 2015-05-14:

PASSED: Continuous integration, rev:208
http://jenkins.qa.ubuntu.com/job/content-hub-ci/256/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-amd64-ci/52
    SUCCESS: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-armhf-ci/52
        deb: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-armhf-ci/52/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/content-hub-vivid-i386-ci/52

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/content-hub-ci/256/rebuild

review: Approve (continuous-integration)

Revision history for this message

Ken VanDine (ken-vandine) wrote on 2015-05-14:

Are there any related MPs required for this MP to build/function as expected? Please list.

* No

Is your branch in sync with latest trunk (e.g. bzr pull lp:trunk -> no changes)

* Yes

Did you perform an exploratory manual test run of your code change and any related functionality on device or emulator?

* Yes

Did you successfully run all tests found in your component's Test Plan (https://wiki.ubuntu.com/Process/Merges/TestPlan/content-hub) on device or emulator?

* Yes, plus I ran the url-dispatcher test in the description. I'll add that to the test plan after this lands

If you changed the UI, was the change specified/approved by design?

* No change

If you changed UI labels, did you update the pot file?

* No change

If you changed the packaging (debian), did you add a core-dev as a reviewer to this MP?

* There are packaging changes, I'm a core-dev

Revision history for this message

Michael Sheldon (michael-sheldon) wrote on 2015-05-15:

This doesn't appear to obey apparmor profiles, so as it stands this could potentially give unrestricted access to all files owned by the phablet user.

For example, creating a simple QML app that calls:

Qt.openUrlExternally("content:?pkg=com.ubuntu.developer.ken-vandine.hub-importer&url=file:///home/phablet/.ssh/known_hosts");

Will result in a user's SSH known_hosts file being sent to the hub-importer app (but potentially an app could be using this to send files directly back to itself and it could be grabbing much more important files if they exist, like ~/.ssh/id_rsa).

Unfortunately I don't think applying the apparmor profile of the app which called url-dispatcher will be enough either, as a malicious developer could create a website like http://mikeasoft.com/~mike/urlhack.php which does a header redirect to "content:?pkg=com.ubuntu.developer.ken-vandine.hub-importer&url=file:///home/phablet/.ssh/known_hosts". They would then call Qt.openUrlExternally("http://mikeasoft.com/~mike/urlhack.php") in their app, which would launch the webbrowser. The urlhack page would then cause the webbrowser to issue the request to the url-dispatcher instead of the originating app, and since the webbrowser is unconfined this would again provide a mechanism for accessing all of a user's files from a confined app.