1589974 - Extension block request: Page Translator

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, task)

Description

[Andreas Wagner [:TheOne] [use NI]]

Extension name	Page Translator
Extension versions affected	<all versions>
Platforms affected	<all platforms>
Block severity	hard

Reason

I’ve reviewed the add-ons and confirmed they are executing remote code.

Extension GUIDs

{a059a924-e43a-495d-9620-ad8c111d62d9}
{79f4bfc6-b1da-4dc4-85cc-ecbcc5dd152e}

Comment 1

[Andreas Wagner [:TheOne] [use NI]]

The block has been pushed.

Comment 2

[Jeremiah Lee]

I accept the blocking of the id that was previously distributed via AMO. One of these is self-distributed.

Prior to now, my engagement with people at Mozilla has been that Page Translator's loading external code was permissible, but only if self-distributed. Has there been a policy change?

More so, when is Firefox going to have in-page language translation in order to be competitive with Chrome and Edge?

Comment 3

[Jeremiah Lee]

(In reply to Andreas Wagner [:TheOne] [use NI] from comment #1)

The block has been pushed.

Andreas, we have previously engaged. If you need a reminder of our conversation, you can view it at https://github.com/jeremiahlee/page-translator/issues/12

You were the one who said it would have to be distributed outside of AMO.

Loading external scripts seems to be absent from the current policy guidelines. It used to be explicitly stated. Could you point me to where this is currently explicitly stated?

Comment 4

[Andreas Wagner [:TheOne] [use NI]]

Mozilla's add-on policies are listed at https://extensionworkshop.com/documentation/publish/add-on-policies/

Comment 5

[Jeremiah Lee]

(In reply to Andreas Wagner [:TheOne] [use NI] from comment #4)

Mozilla's add-on policies are listed at https://extensionworkshop.com/documentation/publish/add-on-policies/

This policy does not state executing remote code is prohibited.

Comment 6

[Andreas Wagner [:TheOne] [use NI]]

It does:

Add-ons must be self-contained and not load remote code for execution.

Comment 7

[Jeremiah Lee]

The pages previously hosted on MDN now redirect to this new site, which does not have an edit history. Previously, self-distributed side-loaded add-ons were permitted to execute remote code. Why was the self-distributed add-on in this ticket blocked?

Comment 8

[Andreas Wagner [:TheOne] [use NI]]

I'm sorry this is not a discussion forum. Your add-on has been blocked because it violates out policies which explicitly disallow execution of remote code.

If you have further questions, please email amo-admins AT mozilla DOT com.