1213919 - Need to use a 'permitted-list' for handling certificates when opening signed packages for reviewers

Status: RESOLVED FIXED

(Core Graveyard :: DOM: Apps, defect, P1)

Description

[David Durst [:ddurst]]

In https://mxr.mozilla.org/mozilla-central/source/dom/apps/Webapps.jsm#3726, the reviewer certs are associated with the root "/reviewers/" which is true for webapps, but not for add-ons (those are using /content/addon/review/).

Fabrice suggested a permitted list instead of additional hard-coding.

This is currently blocking reviewer approval of submitted add-ons for 2.5.

Comment 1

[[:fabrice] Fabrice Desré]

Attachment: reviewer-cert-paths.patch

David, can you test this patch locally to verify?

Comment 2

[Andrew Williamson [:eviljeff]]

(In reply to [:fabrice] Fabrice Desré from comment #1)
> Created attachment 8672775 [details] [diff] [review]
> reviewer-cert-paths.patch

It needs to apply to production as well as a dev - the patch is only changing dev.

Comment 3

[Fernando Jiménez Moreno [:ferjm]]

Comment on attachment 8672775 [details] [diff] [review]
reviewer-cert-paths.patch

Review of attachment 8672775 [details] [diff] [review]:
-----------------------------------------------------------------

LGTM

Comment 4

[Pulsebot]

https://hg.mozilla.org/integration/b2g-inbound/rev/c80eaf2d0f22

Comment 5

[Andrew Williamson [:eviljeff]]

can you fix this to apply to production marketplace too?

Comment 6

[[:fabrice] Fabrice Desré]

Bustage follow up:

https://hg.mozilla.org/integration/b2g-inbound/rev/2bd66074e01a

(In reply to Andrew Williamson [:eviljeff] from comment #5)
> can you fix this to apply to production marketplace too?

I did in the followup.

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c80eaf2d0f22

Comment 8

[David Durst [:ddurst]]

Reopening based on https://bugzilla.mozilla.org/show_bug.cgi?id=1213860#c6

Comment 9

[David Durst [:ddurst]]

(Pasting here from bug 1213860 to save you a crosslink)

https://marketplace.firefox.com/extension/1ee2f3ed13e842fab67afed75492333b/manifest.json is 404 because it's the public mini-manifest URL. The reviewer mini-manifest URL is different, it's per version and the prefix is /extension/reviewers/. 

I'm not sure what's causing your issue, but in any case the whitelist to pick reviewer certs in Gecko seems wrong to me:
https://dxr.mozilla.org/mozilla-central/source/b2g/app/b2g.js#1068
https://dxr.mozilla.org/mozilla-central/source/dom/apps/Webapps.jsm#3746

Instead of whitelisting "/reviewers/,/content/addon/review/" it should whitelist "/reviewers/,/extension/reviewers/", since it's the manifest that needs to be whitelisted, not the install origin.