Executing A Script Via Ajax On Firefox Os Device

My question regards the Apps CSP https://developer.mozilla.org/en-US/Apps/CSP Here it says that all the remote script, inline script, javascript URIs, and other security issues wo

Solution 1:

I believe that is a security feature and the short answer to your question would be NO. To quote the CSP doc that you linked to yourself:

You cannot point a at a remote JavaScript file. This means that all JS files that you reference must be included in your app's package.

If you load a JS file using ajax from a remote server, that JS is not included in your app package. You should be careful to obey CSP restrictions. It is possible to get many things working in the simulator or even the phone while developing without fully complying to CSP, but that does not mean it is OK. When you submit your app in future to any credible marketplace (such as Firefox Marketplace), it will be reviewed carefully to make sure it does not violate CSP restrictions. As a general rule of thumb, I would say any attempt at dynamically evaluating JS code will be a security risk and most likely banned by CSP regulations.

Solution 2:

First, I'll point out that your two examples are not equivalent.

$.ajax({xhrFields: {
        mozSystem:true
     },});

Is the same as

request = new XMLHttpRequest();request.mozSystem = true;

which is not the same as

request = new XMLHttpRequest({ mozSystem: true });

Instead, we can follow the advice in the linked bug report and run the following at application load time:

$.ajaxSetup( {
  xhr: function() {
    returnnewwindow.XMLHttpRequest( {
      mozSystem: true
    } );
  }
} );

This alone should fix your problem. However, if it doesn't work, then the next workaround here is to fetch the script resource as plain text and then load that text content as a script.

However, inline scripts and data: URLs are off-limits for privileged Firefox OS apps. We might still accomplish this goal through a blob: URL, however:

window.URL = window.URL || window.webkitURL;

var request = newXMLHttpRequest({ mozSystem: true });
request.open("GET", "https://cdn.flurry.com/js/flurry.js");

// when the Ajax request resolves, load content into a <script> tag
request.addEventListener("load", function() {
    // make a new blob whose content is the scriptvar blob = newBlob([request.textContent], {type: 'text/javascript'});

    var script = document.createElement('script');
    script.src = window.URL.createObjectURL(blob);

    // after the script finishes, do something else
    script.addEventListener("load", function() {
        flurryLibrary = true;
        FlurryAgent.startSession("7ZFX9Z4CVT66KJBVP7CF");
    });
    document.body.appendChild(script);
});

However, if the script itself does something not allowed by the CSP, then you're definitely out of luck.

Solution 3:

You must use mozSystem and mozAnon properties, example:

var xMLHttpRequest = new XMLHttpRequest({ mozAnon: true, mozSystem: true });

Solution 4:

Its a shame this is a problem, I was hoping on getting loadScript working, as firefoxOS is an environment, and in my app all the application code is HTML5 and local, the current rule is all the scripts need to be loaded in memory in one shot, unless you url load a full page, which means you can not have a persisten wrapper around the site, and ajax inthe pages with assosiated scripts when needed. you would have thought that firefox would have enabled local lazy load for scripts at least. works in chrome, but not in firefox.