625842 - Fix potential URL conflicts with Addon pages in the devhub (slugs)

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P3)

Description

[Kumar McMillan [:kumar]]

Currently these dev URLs exist or about to exist:

/developers/addon/submit/1
/developers/addon/submit/2
...

/developers/addon/validate

But add-on slugs are also supported, such as:

/developers/addon/firebug-0.5/edit

This will conflict with add-ons having slugs such as submit or validate.  We could either blacklist slug names, which would be error prone and cumbersome to maintain, or we could change the URLs for submission, validation, etc.

Comment 1

[Justin Scott [:fligtar]]

Hiding to avoid any opportunistic slugging.

Do add-on slugs check against the username blacklist? If so, we can add the needed slugs to that blacklist. Any slugs unsuitable for one can also be unsuitable for another.

Comment 2

[Jeff Balogh (:jbalogh)]

I put the /addon/:slug matching at the bottom of urls.py for this reason. Anyone trying these shenanigans won't be able to access their add-on.

Comment 3

[Justin Scott [:fligtar]]

So it won't break our tools but it will break their add-on, so we should disallow changing to reserved slugs.

Comment 4

[Wil Clouser [:clouserw]]

(In reply to comment #3)
> So it won't break our tools but it will break their add-on, so we should
> disallow changing to reserved slugs.

I thought there was already a bug for this, but maybe I'm confusing that with the one to support reserved tags.

Comment 5

[Kumar McMillan [:kumar]]

(In reply to comment #2)
> I put the /addon/:slug matching at the bottom of urls.py for this reason.
> Anyone trying these shenanigans won't be able to access their add-on.

for non-malicious users who end up with an Add-on slug 'submit' (is that possible?) then wouldn't their time on devhub be sad and confusing?

Seems to me like an easier fix would be to provide different URLs as long as breaking historic remora URLs isn't a problem.

Comment 6

[Wil Clouser [:clouserw]]

This bug is about:

- adding an `addons_blacklistedslug` table
- disallowing slugs to be saved if their slug exists in that table
- disallowing numeric slugs (to prevent weirdness with our add-on id redirects)
- we don't need a CRUD front end on the table for now, we can run queries on the db manually

Comment 7

[Jeff Balogh (:jbalogh)]

(In reply to comment #6)
> This bug is about:
> 
> - adding an `addons_blacklistedslug` table

Is there any reason to keep this separate from the username blacklist? They serve mostly the same purpose.

> - disallowing numeric slugs (to prevent weirdness with our add-on id redirects)

That's already enforced in Addon.clean_slug.

Comment 8

[Wil Clouser [:clouserw]]

> > - adding an `addons_blacklistedslug` table
> 
> Is there any reason to keep this separate from the username blacklist? They
> serve mostly the same purpose.

Less confusion a year from now

Comment 9

[Andy McKay]

https://github.com/jbalogh/zamboni/commit/8f4ff1b41c6adc2eeb8b941928de8eabef507a1d

Comment 10

[krupa raj[:krupa]]

verified that 

* 'submit' and 'validate' are not allowed slugs anymore.
* numeric slugs are not allowed

For some crazy reason, we do not allow hypen-only slugs.

Comment 11

[krupa raj[:krupa]]

Attachment: post-fix screenshot

Comment 12

[krupa raj[:krupa]]

Attachment: post-fix screenshot