1572527 - pasting links to XPIs will not show domain warning

Status: NEW

(Toolkit :: Add-ons Manager, defect, P3)

Description

[Shane Caraveo (:mixedpuppy)]

If you have foo.com/install.html with a link to an xpi, we warn about installing an addon from foo.com.

If you paste a url foo.com/addon.xpi we do not warn.

I think we should warn in that case. Just because a user pastes a url to install an addon doesn't mean we trust an install from that site.

Comment 1

[Mark Striemer [:mstriemer]]

NI Shane to link with install dialog work being discussed.

Comment 2

[Trishul]

It seems this is intentional and can be changed by setting xpinstall.whitelist.directRequest pref to false.

Refer to these functions

1. https://searchfox.org/mozilla-central/source/toolkit/mozapps/extensions/internal/XPIInstall.jsm#4099
2. https://searchfox.org/mozilla-central/source/toolkit/mozapps/extensions/internal/XPIInstall.jsm#4068

Comment 3

[Mark Striemer [:mstriemer]]

Matching priority of bug 1568635.

Comment 4

[Luca Greco [:rpl] [:luca] [:lgreco]]

Update priority to match bug 1568635 priority.