summaryrefslogtreecommitdiffstats
path: root/devtools/shared/security/prompt.js
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--devtools/shared/security/prompt.js197
1 files changed, 197 insertions, 0 deletions
diff --git a/devtools/shared/security/prompt.js b/devtools/shared/security/prompt.js
new file mode 100644
index 0000000000..b03204cc34
--- /dev/null
+++ b/devtools/shared/security/prompt.js
@@ -0,0 +1,197 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+var DevToolsUtils = require("resource://devtools/shared/DevToolsUtils.js");
+loader.lazyRequireGetter(
+ this,
+ "AuthenticationResult",
+ "resource://devtools/shared/security/auth.js",
+ true
+);
+
+const { LocalizationHelper } = require("resource://devtools/shared/l10n.js");
+const L10N = new LocalizationHelper(
+ "devtools/shared/locales/debugger.properties"
+);
+
+var Client = (exports.Client = {});
+var Server = (exports.Server = {});
+
+/**
+ * During OOB_CERT authentication, a notification dialog like this is used to
+ * to display a token which the user must transfer through some mechanism to the
+ * server to authenticate the devices.
+ *
+ * This implementation presents the token as text for the user to transfer
+ * manually. For a mobile device, you should override this implementation with
+ * something more convenient, such as displaying a QR code.
+ *
+ * @param host string
+ * The host name or IP address of the devtools server.
+ * @param port number
+ * The port number of the devtools server.
+ * @param authResult AuthenticationResult
+ * Authentication result sent from the server.
+ * @param oob object (optional)
+ * The token data to be transferred during OOB_CERT step 8:
+ * * sha256: hash(ClientCert)
+ * * k : K(random 128-bit number)
+ * @return object containing:
+ * * close: Function to hide the notification
+ */
+Client.defaultSendOOB = ({ authResult, oob }) => {
+ // Only show in the PENDING state
+ if (authResult != AuthenticationResult.PENDING) {
+ throw new Error("Expected PENDING result, got " + authResult);
+ }
+ const title = L10N.getStr("clientSendOOBTitle");
+ const header = L10N.getStr("clientSendOOBHeader");
+ const hashMsg = L10N.getFormatStr("clientSendOOBHash", oob.sha256);
+ const token = oob.sha256.replace(/:/g, "").toLowerCase() + oob.k;
+ const tokenMsg = L10N.getFormatStr("clientSendOOBToken", token);
+ const msg = `${header}\n\n${hashMsg}\n${tokenMsg}`;
+ const prompt = Services.prompt;
+ const flags = prompt.BUTTON_POS_0 * prompt.BUTTON_TITLE_CANCEL;
+
+ // Listen for the window our prompt opens, so we can close it programatically
+ let promptWindow;
+ const windowListener = {
+ onOpenWindow(xulWindow) {
+ const win = xulWindow.docShell.domWindow;
+ win.addEventListener(
+ "load",
+ function () {
+ if (
+ win.document.documentElement.getAttribute("id") != "commonDialog"
+ ) {
+ return;
+ }
+ // Found the window
+ promptWindow = win;
+ Services.wm.removeListener(windowListener);
+ },
+ { once: true }
+ );
+ },
+ onCloseWindow() {},
+ };
+ Services.wm.addListener(windowListener);
+
+ // nsIPrompt is typically a blocking API, so |executeSoon| to get around this
+ DevToolsUtils.executeSoon(() => {
+ prompt.confirmEx(null, title, msg, flags, null, null, null, null, {
+ value: false,
+ });
+ });
+
+ return {
+ close() {
+ if (!promptWindow) {
+ return;
+ }
+ promptWindow.document.documentElement.acceptDialog();
+ promptWindow = null;
+ },
+ };
+};
+
+/**
+ * Prompt the user to accept or decline the incoming connection. This is the
+ * default implementation that products embedding the devtools server may
+ * choose to override. This can be overridden via |allowConnection| on the
+ * socket's authenticator instance.
+ *
+ * @param session object
+ * The session object will contain at least the following fields:
+ * {
+ * authentication,
+ * client: {
+ * host,
+ * port
+ * },
+ * server: {
+ * host,
+ * port
+ * }
+ * }
+ * Specific authentication modes may include additional fields. Check
+ * the different |allowConnection| methods in ./auth.js.
+ * @return An AuthenticationResult value.
+ * A promise that will be resolved to the above is also allowed.
+ */
+Server.defaultAllowConnection = ({ client, server }) => {
+ const title = L10N.getStr("remoteIncomingPromptTitle");
+ const header = L10N.getStr("remoteIncomingPromptHeader");
+ const clientEndpoint = `${client.host}:${client.port}`;
+ const clientMsg = L10N.getFormatStr(
+ "remoteIncomingPromptClientEndpoint",
+ clientEndpoint
+ );
+ const serverEndpoint = `${server.host}:${server.port}`;
+ const serverMsg = L10N.getFormatStr(
+ "remoteIncomingPromptServerEndpoint",
+ serverEndpoint
+ );
+ const footer = L10N.getStr("remoteIncomingPromptFooter");
+ const msg = `${header}\n\n${clientMsg}\n${serverMsg}\n\n${footer}`;
+ const disableButton = L10N.getStr("remoteIncomingPromptDisable");
+ const prompt = Services.prompt;
+ const flags =
+ prompt.BUTTON_POS_0 * prompt.BUTTON_TITLE_OK +
+ prompt.BUTTON_POS_1 * prompt.BUTTON_TITLE_CANCEL +
+ prompt.BUTTON_POS_2 * prompt.BUTTON_TITLE_IS_STRING +
+ prompt.BUTTON_POS_1_DEFAULT;
+ const result = prompt.confirmEx(
+ null,
+ title,
+ msg,
+ flags,
+ null,
+ null,
+ disableButton,
+ null,
+ { value: false }
+ );
+ if (result === 0) {
+ return AuthenticationResult.ALLOW;
+ }
+ if (result === 2) {
+ return AuthenticationResult.DISABLE_ALL;
+ }
+ return AuthenticationResult.DENY;
+};
+
+/**
+ * During OOB_CERT authentication, the user must transfer some data through some
+ * out of band mechanism from the client to the server to authenticate the
+ * devices.
+ *
+ * This implementation prompts the user for a token as constructed by
+ * |Client.defaultSendOOB| that the user needs to transfer manually. For a
+ * mobile device, you should override this implementation with something more
+ * convenient, such as reading a QR code.
+ *
+ * @return An object containing:
+ * * sha256: hash(ClientCert)
+ * * k : K(random 128-bit number)
+ * A promise that will be resolved to the above is also allowed.
+ */
+Server.defaultReceiveOOB = () => {
+ const title = L10N.getStr("serverReceiveOOBTitle");
+ const msg = L10N.getStr("serverReceiveOOBBody");
+ let input = { value: null };
+ const prompt = Services.prompt;
+ const result = prompt.prompt(null, title, msg, input, null, { value: false });
+ if (!result) {
+ return null;
+ }
+ // Re-create original object from token
+ input = input.value.trim();
+ let sha256 = input.substring(0, 64);
+ sha256 = sha256.replace(/\w{2}/g, "$&:").slice(0, -1).toUpperCase();
+ const k = input.substring(64);
+ return { sha256, k };
+};