1293303 - User.js file is not deleted by Youtube Unlocker Remediation add-on in case it does NOT contain "xpinstall.signatures.required" preference set

Status: RESOLVED INVALID

(Toolkit :: Add-ons Manager, defect)

Description

[Brindusa Tot, DTE]

Attachment: user.js

[Affected versions]:
- Firefox 44
- Firefox 44.0.1

[Affected platforms]:
- Windows 10, Windows XP
- Mac OS X 10.10
- Ubuntu 14.04

[Steps to reproduce]:
1. Launch Firefox with a new profile
2. Go to about:config and disable the following preferences:
xpinstall.signatures.required
extensions.blocklist.enabled
3. Into the profile folder add a user.js file, with content from attachment(make sure it does NOT contain "xpinstall.signatures.required" preference set)
4. Go to Add-ons Manager -> Extensions -> Settings -> Install Add-ons from file -> Install the YouTube Unblocker add-on and the watcher add-on
5. Restart Firefox
6. Go to Add-ons Manager -> Extensions -> Settings -> Install Add-ons from file -> Install the YouTube Unblocker Remediation add-on 


[Expected result]:
The YouTube Unblocker should be disabled.
Watcher add-on should be removed.
user.js and secmodd.db files should be deleted.

[Actual result]:
The YouTube Unblocker is disabled. Watcher is removed. Secmodd.db is deleted, but user.js is NOT deleted.


[Additional Notes]
The user.js file is taken from bug 1258565, Comment 49, except that I removed the "xpinstall.signatures.required" preference because otherwise the YouTube Unblocker Remediation add-on is disabled before the complete malware being removed(secmodd.db file is not deleted and also the watcher is not removed from extensions).

Comment 1

[Kris Maglione [:kmag]]

This is intentional. The user.js file is only removed if it changes the specific set of preferences changed by the watcher add-on. Otherwise we might wind up removing legitimate user.js files created by users.

You can change the value of that preference from true to false (which is what all but the latest version of the malware used), though, and it should still work.

Comment 2

[Brindusa Tot, DTE]

Hi Kris,

If I am not doing any modification to the user.js file and the "xpinstall.signatures.required" is not deleted from the file, then the following is observed:
 - user.js is deteled
 - secmodd.db is NOT deleted 
 - the watcher add-on is NOT removed from extensions
 - also the preference "xpinstall.signatures.required" is set back to default value, true(which is correct), just that because the Youtube Unblocker Remediation add-on is unsigned, it is also DISABLED.


I am not sure why the secmodd.db and watcher are not removed. Could it be because the remediation add-on is not doing a good job or it does not have enough time because it is disabled too early?

Please advice.