1024073 - Roblox Plugin launcher is not whitelisted, hampering user experience

Status: VERIFIED FIXED

(Firefox Graveyard :: Plugin Click-To-Activate Whitelist, defect)

Description

[Arseny Kapoulkine]

Plugin name: Roblox Launcher Plugin
Vendor: ROBLOX
Point of contact: Arseny Kapoulkine <[e-mail]>
Current version: 1.2.8.24
Download URL: http://setup.roblox.com/version-4d8b1955ef2740b3-Roblox.exe
Sample URL of plugin in use: http://www.roblox.com/THE-MAD-MURDERER-Accessories-place?id=152594797

Quick info about ROBLOX;

ROBLOX allows builders to create elaborate online environments that simulate the real world, then share and play them with the community. ROBLOX is ranked #1 among kids entertainment sites by comScore in the U.S. for daily visitors, total minutes, total page views, total visits, and average visits per visitor. ROBLOX generates over 3.5 billion page views and 62 million total engagement hours each month.

Plugin details:

Windows:

Roblox Launcher Plugin

    File: NPRobloxProxy.dll
    Path: C:\Users\Arseny.ROBLOX\AppData\Local\Roblox\Versions\version-4d8b1955ef2740b3\NPRobloxProxy.dll
    Version: 1.2.8.24
    State: Enabled
    Roblox Launcher Plugin

MIME Type	Description	Suffixes
application/x-vnd-roblox-launcher	Roblox Launcher Plugin	launcher

Mac OS X:

Roblox Launcher Plugin

File: NPRoblox.plugin
Path: /Users/zeux/Library/Internet Plug-Ins/NPRoblox.plugin
Version: 1.0.2.12
State: Enabled
Launches Roblox Application
MIME Type	Description	Suffixes
application/x-vnd-roblox-launcher	

The plugin filename is always NPRobloxProxy.dll/NPRoblox.plugin; the exact path to the plugin differs version-to-version and user-to-user. The current version is 1.2.8.24 on Windows and 1.0.2.12 and OSX, but it's not fixed - sometimes we update it.

We are not aware of any security issues in the plugin. The plugin acts as a very thin shim so that once the user installs the Roblox desktop client, the Play button on the web site takes him/her directly into the game without issuing an additional download prompt. We can provide plugin source upon request.

The general sequence is as follows:
- When a user clicks Play for the first time, JS portion of the website determines that a plugin is not installed and prompts a download of the installer.
- Installer installs a plugin; the second time user clicks Play JS portion uses the plugin-provided object to launch the desktop client directly (this part does *not* work in Firefox 30 unless you change the plugin settings to Always Activate)

Note that right now unfortunately even click-to-activate does not work because the plugin does not have a visible frame - there's nowhere for the user to click on...

We plan to migrate away from NPAPI by installing a custom protocol and handling the protocol error by redirecting the web page to download the installer.

Comment 1

[Marco Mucci [:MarcoM]]

Added to Iteration 34.1

Comment 2

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Attachment: Patch v1

Comment 3

[Blair McBride [:Unfocused] (UNAVAILABLE)]

https://hg.mozilla.org/integration/fx-team/rev/acd333921065

Comment 4

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/acd333921065

Comment 5

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Arseny: This has landed in Nightly. Could you please do a QA pass using a Nightly build from http://nightly.mozilla.org/. Using a new Firefox profile (https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles) to ensure that the plugin activates without a popup and appears as "Always Activate" in the Add-ons Manager. Report back in this bug when QA is complete. Please try to complete QA by the end of the week.

Comment 6

[Bogdan Maris, Desktop QA]

I`ve installed this plugin on Windows 7 64 and Mac OS X 10.9.4 and using latest Nightly (34.0a1 - 20140727030204) I can confirm that Roblox plugin is whitelisted in Windows (it appears with Always Activate) but not in Mac (it appears with Ask to Activate in about:addons).

Comment 7

[Arseny Kapoulkine]

I can confirm that Windows works as expected - on a fresh profile, plugin is white-listed by default.
I can also confirm that MacOS does not work as expected.

Maybe the plugin identifier is wrong? Nightly displays "File" in the plugin information as:
NPRobloxProxy.dll on Windows
NPRoblox.plugin on MacOSX

But I'm not sure if this is the same token that's used for plugin whitelisting or not.

Comment 8

[Arseny Kapoulkine]

Ah, wait, there's a typo in the patch.

    1.12 +// Roblox Launcher Plugin, bug 1024073
    1.13 +#ifdef XP_WIN
    1.14 +pref("plugin.state.nprobloxproxy", 2);
    1.15 +#endif
    1.16 +#ifdef XP_MACOSX
    1.17 +pref("plugins.state.nproblox", 2);
    1.18 +#endif

For Mac OSX it changes "plugins.state.nproblox", but it should change "plugin.state.nproblox".

Comment 9

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Foiled by a typo :\

Backout: https://hg.mozilla.org/integration/fx-team/rev/54598200f301
Reland: https://hg.mozilla.org/integration/fx-team/rev/ed3a204d252f

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ed3a204d252f

Comment 11

[Bogdan Maris, Desktop QA]

Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Nightly.
Used the demo page from comment 1 and different other games from the same website, Roblox Launcher Plugin 1.2.8.25 is set to 'Always Activate' by default in about:addons.

Comment 12

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Arseny: Could you re-do QA on the latest Nightly build? Thanks!

Comment 13

[Arseny Kapoulkine]

Verified, works on both Windows and Mac OS X now.

Comment 14

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Benjamin: Guessing you'll want this in your spreadsheet.

Comment 15

[Benjamin Smedberg]

Comment on attachment 8460692 [details] [diff] [review]
Patch v1

Approval Request Comment
[Feature/regressing bug #]: whitelist request
[User impact if declined]:
[Describe test coverage new/current, TBPL]:
[Risks and why]: very low
[String/UUID change made/needed]: none

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/c49756028e40
https://hg.mozilla.org/releases/mozilla-beta/rev/cda6534d9780

Comment 17

[Arseny Kapoulkine]

Thank you for the help, everyone!

I'm slightly confused by the tags here - what FF version will these changes ship in?

Comment 18

[Sylvestre Ledru [:Sylvestre]]

Firefox 32 will have this change. It will be released on 2014-09-02

Comment 19

[Arseny Kapoulkine]

Awesome, thanks.

Comment 20

[Bogdan Maris, Desktop QA]

Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Aurora and Firefox 32 beta 5.
Used the demo page from comment 1 and different other games from the same website, Roblox Launcher Plugin 1.2.8.25 is set to 'Always Activate' by default in about:addons.

Comment 21

[[e-mail]]

(In reply to Bogdan Maris [:bogdan_maris], Release Desktop QA from comment #20)

Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Aurora
and Firefox 32 beta 5.
Used the demo page from comment 1 and different other games from the same
website, Roblox Launcher Plugin 1.2.8.25 is set to 'Always Activate' by
default in about:addons.

<a href="https://free-robuxnoverification.com/">Deepa</a>

Comment 22

[[e-mail]]

(In reply to [e-mail] from comment #21)

(In reply to Bogdan Maris [:bogdan_maris], Release Desktop QA from comment #20)

Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Aurora
and Firefox 32 beta 5.
Used the demo page from comment 1 and different other games from the same
website, Roblox Launcher Plugin 1.2.8.25 is set to 'Always Activate' by
default in about:addons.

https://free-robuxnoverification.com/