1458334 - Add xpi path

Status: RESOLVED WONTFIX

(DevTools :: about:debugging, enhancement, P5)

Description

[rctgamer3]

Extension ID is listed, internal UUID is listed, add-on xpi file path isn't. Example: If an add-on is malicious and somehow blocks about:addons, having the .xpi location listed in about:debugging helps with locating the responsible file.

Comment 1

[Julian Descottes [:jdescottes]]

Luca, Mark: what do you think about this feature request?

Comment 2

[Luca Greco [:rpl] [:luca] [:lgreco]]

I'm not sure that it would stop a malicious extension (if it is able to "somehow block" about:addons, it could likely do the same for about:debugging), nevertheless I am not against showing the location from where the addon is being loaded (in the about:debugging#addons page).

(as a side note, a briefly checked what Chrome shows in the "chrome://extensions" page: the extensions that are installed temporarily from disk have the path to the location on disk listed in the details, on the contrary it seems that any signed extensions installed from the Chrome store doesn't list the file location and it just provides a link to the related webpage in the Chrome store).

Comment 3

[Mark Striemer [:mstriemer]]

It seems like it would be reasonable to show it but I'm not sure how useful it is. The suggested use case, as Luca pointed out, might not be solved by this.

The way we're currently getting the file path for temporary extensions only works for temporary extensions. For system extensions it is undefined and for AMO extensions it is the URL for the extension.

I suggested in bug 1330741 comment 3 that we could use `_sourceBundle` on AddonInternal to get this, for example `XPIDatabase.getAddons().map(a => a._sourceBundle.path)` would list all the paths for all extensions. These paths are pretty long and I'm not sure how helpful they are but they could be shown.

An example path is `/Users/me/Library/Application Support/Firefox/Profiles/4shf7xdt.default/extensions/@react-devtools.xpi`.

Without some way of hiding this until the user wanted it I'm not sure it's worth adding.

Comment 4

[Julian Descottes [:jdescottes]]

I don't think we will implement this. We show the path to the manifest file, and for temporary extensions we show the location. about:debugging is not the ideal place to diagnose issues from malicious addons.