The `uninstallAddon` method of the addons actor was introduced in bug 1823457 to support the removal of temporarily loaded extensions. The implementation is quite generic, and allows uninstallation of any extension: https://searchfox.org/mozilla-central/rev/6fc2f6d5335fb6f70f780b5fea5ed77b0719c3b5/devtools/server/actors/addon/addons.js#70-72 The logic above does not check for the presence of `AddonManager.PERM_CAN_UNINSTALL`, and consequently the remote debugging protocol could be used to uninstall an add-on despite enterprise policy settings. Since we don't need to, we should adjust the check to only permit the uninstallation of temporarily installed extensions. If we ever need to expand it, we should at least check for PERM_CAN_UNINSTALL prior to calling `addon.uninstall()`.
Bug 1824346 Comment 0 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
The `uninstallAddon` method of the addons actor was introduced in bug 1823457 to support the removal of temporarily loaded extensions. The implementation is quite generic, and allows uninstallation of any extension: https://searchfox.org/mozilla-central/rev/6fc2f6d5335fb6f70f780b5fea5ed77b0719c3b5/devtools/server/actors/addon/addons.js#70-72 The logic above does not check for the presence of `AddonManager.PERM_CAN_UNINSTALL`, and consequently the remote debugging protocol could be used to uninstall an add-on despite enterprise policy settings. Since we don't need to support uninstallation of any add-on, we should adjust the check to only permit the uninstallation of temporarily installed extensions. If we ever need to expand it, we should at least check for PERM_CAN_UNINSTALL prior to calling `addon.uninstall()`.