1029654 - Request for whitelisting Box Edit plugin

Status: VERIFIED FIXED

(Firefox Graveyard :: Plugin Click-To-Activate Whitelist, defect)

Description

[Ryan Knotts]

<<Please supply the following information for new plugin whitelist requests>>

Plugin name: Box Edit
Vendor: Box, Inc.
Point of contact: Ryan Knotts ([e-mail])
Current version: Windows 2.0.31, Mac 1.2.13
Download URL: http://www.box.com/static/BoxEdit/BoxEditInstaller.exe
  http://www.box.com/static/BoxEdit/BoxEditInstaller.dmg
Sample URL of plugin in use: 

Plugin details: 
Plugin is used to communicate between Box web app and Box Edit client which runs on the user's machine. Plugin can be invoked by going to Box web app and right-clicking on a file to bring up the context menu, then selecting 'Edit using <application name>'.

Mac -
Box Edit
    File: Box Edit.plugin
    Path: /Users/rknotts/Library/Internet Plug-Ins/Box Edit.plugin
    Version: 1.2.13(333)
    State: Enabled
    Box Edit - A tool for editing files on Box with desktop applications

MIME Type	Description	Suffixes
application/x-boxedit	Box Edit - A tool for editing files on Box with desktop applications	

Windows -
Box Edit
    File: npBoxEdit.dll
    Path: C:\Users\rknotts\AppData\Local\Box\Box Edit\npBoxEdit.dll
    Version: 2.0.31.311
    State: Enabled
    Box Edit

MIME Type	Description	Suffixes
application/x-boxedit	Box Edit

Are there any variations in the plugin file name, MIME types, description, or version from one release to the next? Version numbers increment with each release. Filename, MIME types, and description remain the same.

Are there any known security issues in current or older versions of the plugin? No

Comment 1

[Benjamin Smedberg]

You will need to provide details about your transition plan away from NPAPI plugins and to native web technologies. You can do that here as a public bug comment or via a private email to [e-mail]

Comment 2

[Ryan Knotts]

Sure thing.

The current plan is to install a local webserver on the client machine with the Box Edit native application which listens only on the loopback interface, and is accessible through CORS calls from the javascript layer. We have proof of concept code, and are currently developing a prototype. This approach is similar to the approach used by Spotify and described here:
http://cgbystrom.com/articles/deconstructing-spotifys-builtin-http-server/

Thanks much for your help!

Comment 3

[Marco Mucci [:MarcoM]]

Added to Iteration 34.1

Comment 4

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Attachment: Patch v1

Comment 5

[Blair McBride [:Unfocused] (UNAVAILABLE)]

https://hg.mozilla.org/integration/fx-team/rev/5cebb1e06e25

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/5cebb1e06e25

Comment 7

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Ryan: This has landed in Nightly. Could you please do a QA pass using a Nightly build from http://nightly.mozilla.org/. Using a new Firefox profile (https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles) to ensure that the plugin activates without a popup and appears as "Always Activate" in the Add-ons Manager. Report back in this bug when QA is complete. Please try to complete QA by the end of the week.

Comment 8

[Bogdan Maris, Desktop Test Engineering]

I`ve installed this plugin on Windows 7 64 and Mac OS X 10.9.4 and using latest Nightly (34.0a1 - 20140727030204) I saw that Box Edit plugin is not whitelisted in Windows nor Mac (it appears with Ask to Activate in about:addons).

Comment 9

[Georg Fritzsche [:gfritzsche]]

Comment on attachment 8460693 [details] [diff] [review]
Patch v1

Review of attachment 8460693 [details] [diff] [review]:
-----------------------------------------------------------------

::: browser/app/profile/firefox.js
@@ +818,5 @@
>  #endif
>  
> +// Box Edit, bug 1029654
> +#ifdef XP_WIN
> +pref("plugins.state.npboxedit", 2);

Also typos here, "plugins.state.*" vs "plugin.state.*".

Comment 10

[Martín Cirillo]

As Ryan Knotts is out for a couple of weeks, I've been asked to follow this case. Please let me know if there is any more information you need I can provide. Thanks

Comment 11

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Foiled by a typo :\

Backout: https://hg.mozilla.org/integration/fx-team/rev/54598200f301
Reland:  https://hg.mozilla.org/integration/fx-team/rev/0b470cc18166

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/0b470cc18166

Comment 13

[Bogdan Maris, Desktop Test Engineering]

Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Nightly.
Used different actions on https://app.box.com to verify that the plugin is whitelisted, Box Edit 2.0.39.323 is set to 'Always Activate' by default in about:addons.

Comment 14

[Blair McBride [:Unfocused] (UNAVAILABLE)]

Martín: Could you re-do QA on the latest Nightly build (see comment 7)? Thanks!

Comment 15

[Benjamin Smedberg]

Comment on attachment 8460693 [details] [diff] [review]
Patch v1

Approval Request Comment
[Feature/regressing bug #]: whitelist request
[User impact if declined]:
[Describe test coverage new/current, TBPL]:
[Risks and why]: very low
[String/UUID change made/needed]: none

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/01c1b51d9bfc
https://hg.mozilla.org/releases/mozilla-beta/rev/4d812a850eb1

Comment 17

[Bogdan Maris, Desktop Test Engineering]

Verified as fixed on Windows 7 64bit and Mac OS X 10.9.4 using latest Aurora and Firefox 32 beta 5.
Used different actions on https://app.box.com to verify that the plugin is whitelisted, Box Edit 2.0.39.323 is set to 'Always Activate' by default in about:addons.

Comment 18

[Martín Cirillo]

Have tested it in Nigthly build and Box Plugin it's on whitelist

Will try in Firefox beta versions

Comment 19

[jelani.jackson]

I have read the note on https://developer.mozilla.org/en-US/Add-ons/Plugins and wonder if the support for plugins (NPAPI) will be completely removed and if so by what date?

Comment 20

[Georg Fritzsche [:gfritzsche]]

This is really the wrong place to ask about this, you could e.g. try the plugins mailing list:
https://lists.mozilla.org/listinfo/dev-tech-plugins

However, there are currently no plans to remove NPAPI on desktop.