Executing a script via AJAX on Firefox OS device

问题

My question regards the Apps CSP https://developer.mozilla.org/en-US/Apps/CSP

Here it says that all the remote script, inline script, javascript URIs, and other security issues won't work on a Firefox OS app.

So, I tried to download a script that is necessary for my app (Flurry and Ad service) and neither would work on the device. The way I made the call was with AJAX, that way I would avoid the remote and inline scripting that both scripts ment. In the simulator works perfectly, but on the device the ads never show and the Flurry session never starts.

Here is the part of my code where I make the AJAX call for Flurry:

$.ajax({
            url: 'https://cdn.flurry.com/js/flurry.js',
            dataType: "script",
            xhrFields: {
                mozSystem: true
            },
            success: function(msg){
                console && console.log("Script de Flurry: luego de la descarga en AJAX "+msg);
                flurryLibrary = true;
                FlurryAgent.startSession("7ZFX9Z4CVT66KJBVP7CF");
            },
            error:function(object,status,errortxt){
                console && console.log("The script wasn't downloaded as text. The error:" +errortxt);
                flurryLibrary = false;
            },
            always: function(object,status,errortxt){
                console && console.log("The script may or may not be downloaded or executed. The error could be:" +errortxt);
            }
        });

In my app I use the systemXHR permission and make the calls for other websites using this line:

request = new XMLHttpRequest({ mozSystem: true });

Wich is the same as using the xhrFields{mozSystem:true} in the AJAX call.

I believe it's not a cross domain problem because in the rest of my app I make calls for xml files that are not in my domain, and the calls are returned succesfully.

So, my question is, can a Firefox OS app execute scripts that are downloaded via AJAX? Is there a way to get around this problem?

Thank you for your time.

PS: I forgot to add that my app is privileged, just in case you ask

回答1:

I believe that is a security feature and the short answer to your question would be NO. To quote the CSP doc that you linked to yourself:

You cannot point a at a remote JavaScript file. This means that all JS files that you reference must be included in your app's package.

If you load a JS file using ajax from a remote server, that JS is not included in your app package. You should be careful to obey CSP restrictions. It is possible to get many things working in the simulator or even the phone while developing without fully complying to CSP, but that does not mean it is OK. When you submit your app in future to any credible marketplace (such as Firefox Marketplace), it will be reviewed carefully to make sure it does not violate CSP restrictions. As a general rule of thumb, I would say any attempt at dynamically evaluating JS code will be a security risk and most likely banned by CSP regulations.

回答2:

First, I'll point out that your two examples are not equivalent.

$.ajax({
    xhrFields: {
        mozSystem: true
     },
});

Is the same as

request = new XMLHttpRequest();
request.mozSystem = true;

which is not the same as

request = new XMLHttpRequest({ mozSystem: true });

Instead, we can follow the advice in the linked bug report and run the following at application load time:

$.ajaxSetup( {
  xhr: function() {
    return new window.XMLHttpRequest( {
      mozSystem: true
    } );
  }
} );

This alone should fix your problem. However, if it doesn't work, then the next workaround here is to fetch the script resource as plain text and then load that text content as a script.

However, inline scripts and data: URLs are off-limits for privileged Firefox OS apps. We might still accomplish this goal through a blob: URL, however:

window.URL = window.URL || window.webkitURL;

var request = new XMLHttpRequest({ mozSystem: true });
request.open("GET", "https://cdn.flurry.com/js/flurry.js");

// when the Ajax request resolves, load content into a <script> tag
request.addEventListener("load", function() {
    // make a new blob whose content is the script
    var blob = new Blob([request.textContent], {type: 'text/javascript'});

    var script = document.createElement('script');
    script.src = window.URL.createObjectURL(blob);

    // after the script finishes, do something else
    script.addEventListener("load", function() {
        flurryLibrary = true;
        FlurryAgent.startSession("7ZFX9Z4CVT66KJBVP7CF");
    });
    document.body.appendChild(script);
});

However, if the script itself does something not allowed by the CSP, then you're definitely out of luck.

回答3:

You must use mozSystem and mozAnon properties, example:

var xMLHttpRequest = new XMLHttpRequest({ mozAnon: true, mozSystem: true });

回答4:

Its a shame this is a problem, I was hoping on getting loadScript working, as firefoxOS is an environment, and in my app all the application code is HTML5 and local, the current rule is all the scripts need to be loaded in memory in one shot, unless you url load a full page, which means you can not have a persisten wrapper around the site, and ajax inthe pages with assosiated scripts when needed. you would have thought that firefox would have enabled local lazy load for scripts at least. works in chrome, but not in firefox.

来源：https://stackoverflow.com/questions/20052670/executing-a-script-via-ajax-on-firefox-os-device

标签

javascript

jquery

ajax

firefox-os