1579734 - Add-ons manager extension Permissions tab hides domains when there are too many

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, defect, P3)

Description

[dam1784]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:69.0) Gecko/20100101 Firefox/69.0

Steps to reproduce:

1. Get an addon which accesses data on multiple websites, in my case "Old Reddit Redirect".
2. Go to "about:addons" -> Extensions -> "Old Reddit Redirect" -> permissions

Actual results:

These are the permission shown:

Access your data for reddit.com
Access your data for www.reddit.com
Access your data for np.reddit.com
Access your data on 2 other sites
Learn more about permissions

Expected results:

What are the "2 other sites" ?

Why on earth is firefox hiding this from me? Since firefox refuses to tell me I can only assume that they are in some way malicious. Is this addon reading my data for "gmail.com"? Or maybe its accessing this website "https://bugzilla.mozilla.org"? I have no way to know what these permissions are, which is of course the entire purpose of the "permissions" settings page!

"2 other sites" is a bunch of hand waving. It is not secure, and it certainly does not make me (the user) feel secure about this add-on.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 2

[Mark Striemer [:mstriemer]]

This is because these strings also appear in the popup you see when installing an add-on, and we don't want that popup to be overly large. We should update the function that generates these strings to remove the limit [1] of only showing up to 4 sites/wildcards and instead show all on this page.

[1] https://searchfox.org/mozilla-central/rev/878bbf3cb8897a208454df27535f3522ab482cf2/toolkit/components/extensions/Extension.jsm#1329

Comment 4

[Sound]

Hi, is there any updates on this issue? It's impossible to audit add-ons after updates in permissions.

Comment 5

[mirefly]

Attachment: Bug 1579734 - Add-ons manager extension Permissions tab always shows all domains. r=robwu

Comment 6

[mirefly]

Attachment: Bug 1579734 - Change param name to showAllOrigins r?robwu

Depends on D66510

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/491669756062
Add-ons manager extension Permissions tab always shows all domains. r=robwu

Comment 8

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/491669756062