Bug 838308 - mozKeyboard should require a permission to use r=vingtetun a=tef+

b2g/components/Keyboard.jsm

@@ -49,6 +49,30 @@ let Keyboard = {
   },
 
   receiveMessage: function keyboardReceiveMessage(msg) {
+    // If we get a 'Keyboard:XXX' message, check that the sender has the
+    // keyboard permission.
+    if (msg.name != 'Forms:Input') {
+      let mm;
+      try {
+        mm = msg.target.QueryInterface(Ci.nsIFrameLoaderOwner)
+                       .frameLoader.messageManager;
+      } catch(e) {
+        mm = msg.target;
+      }
+
+      // That should never happen.
+      if (!mm) {
+        dump("!! No message manager found for " + msg.name);
+        return;
+      }
+
+      if (!mm.assertPermission("keyboard")) {
+        dump("Keyboard message " + msg.name +
+        " from a content process with no 'keyboard' privileges.");
+        return;
+      }
+    }
+
     switch (msg.name) {
       case 'Forms:Input':
         this.handleFormsInput(msg);

b2g/components/MozKeyboard.js

@@ -18,7 +18,7 @@ XPCOMUtils.defineLazyServiceGetter(this, "cpmm",
 // MozKeyboard
 // -----------------------------------------------------------------------
 
-function MozKeyboard() { } 
+function MozKeyboard() { }
 
 MozKeyboard.prototype = {
   classID: Components.ID("{397a7fdf-2254-47be-b74e-76625a1a66d5}"),
@@ -36,6 +36,15 @@ MozKeyboard.prototype = {
   }),
 
   init: function mozKeyboardInit(win) {
+    let principal = win.document.nodePrincipal;
+    let perm = Services.perms
+               .testExactPermissionFromPrincipal(principal, "keyboard");
+    if (perm != Ci.nsIPermissionManager.ALLOW_ACTION) {
+      dump("No permission to use the keyboard API for " +
+           principal.origin + "\n");
+      return null;
+    }
+
     Services.obs.addObserver(this, "inner-window-destroyed", false);
     cpmm.addMessageListener('Keyboard:FocusChange', this);
 

dom/apps/src/PermissionsTable.jsm

@@ -261,6 +261,11 @@ this.PermissionsTable =  { geolocation: {
                              privileged: DENY_ACTION,
                              certified: ALLOW_ACTION
                            },
+                           "keyboard": {
+                             app: DENY_ACTION,
+                             privileged: DENY_ACTION,
+                             certified: ALLOW_ACTION
+                           },
                          };
 
 /**