1119331 - Failure during add-on submission process can lead to orphaned add-on listings

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect)

Description

[Jorge Villalobos [:jorgev] (he/him)]

Every now and then we get requests to fix add-on listings because something failed during the upload process and developers end up in a state where:

* The can't continue with the previous submission process.
* If they try start over, the listing and ID are already there in an Incomplete state, but not linked to their account, so they get a duplicate ID error.

In those cases I need to manually set the owner so they can submit a new version.

We need to make sure that the add-on ID and owner are linked to the listing at the same time.

Comment 1

[muthusmkmtp]

Hi !! My addon has been reviewed by AMO editors and rejected with a reason 

"Your add-on creates DOM nodes from HTML strings containing potentially unsanitized data, by assigning to innerHTML, jQuery.html, or through similar means. Aside from being inefficient, this is a major security risk. For more information, see https://developer.mozilla.org/en/XUL_School/DOM_Building_and_HTML_Insertion "

The AMO-editors mentioned only the above reason , I doubt that 

 - Whether the editors reviewed the full code and mentioned their issues or gone through a part of the code and stopped their review once they get this issue.

-

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to muthusmkmtp from comment #1)
> Hi !! My addon has been reviewed by AMO editors and rejected with a reason 

This is not the right place to post this. Please reply to the review email you received with any questions or objections you have about your review.

Comment 3

[Kumar McMillan [:kumar]]

Sorry this took so long to fix. I only just saw the bug.

I'm sure there are many examples of what triggered this, but here's one example: https://github.com/mozilla/olympia/issues/1140#issuecomment-166728840

Fixed in https://github.com/mozilla/olympia/pull/1141

Comment 4

[Kumar McMillan [:kumar]]

Adding qa- because there's no easy way to reproduce an error during submission.

Comment 5

[Kumar McMillan [:kumar]]

The way I tested this was to raise an exception here https://github.com/mozilla/olympia/blob/master/apps/versions/models.py#L150 then I tried to submit the add-on again without raising an exception. I was able to reproduce the orphaned state ('duplicate add-on ID') before my patch.