1735806 - Specifying install_sources still allows installs from addons.mozilla.org

Status: RESOLVED FIXED

(Firefox :: Enterprise Policies, defect, P2)

Description

[Mike Kaply [:mkaply]]

If you specify install_sources in policy, it should only allow installs from that domain.

We still allow installs from addons.mozilla.org in that case

I swear this worked when we first implemented.

The issue is that installs from AMO don't go through isInstallAllowedByPolicy which checks the install_sources list.

Comment 1

[Mike Kaply [:mkaply]]

AMO uses the mozAddonManager API here:

https://searchfox.org/mozilla-central/source/toolkit/mozapps/extensions/AddonManagerWebAPI.cpp

I thought we had code at one point to do this properly, but I guess I'm wrong.

The easiest fix would be to flip "privacy.resistFingerprinting.block_mozAddonManager" if install_sources doesn't contain addons.mozilla.org

I don't think it would be straightforward to call Services.policies.allowedInstallSource(aInstallingPrincipal.URI) from the CPP.iam, d

William, do you have any other thoughts?

Basically this policy allows you to specify the only URLs where addons are allowed to be installed from using match patterns.

Comment 2

[William Durand [:willdurand]]

Looking at the original patch, I don't see any coverage for mozAddonManager. I think we can still call isInstallAllowedByPolicy() for mozAddonManager, probably here: https://searchfox.org/mozilla-central/rev/46ff2252568db36e811109fa4026c8e3c12e9ee1/toolkit/mozapps/extensions/AddonManager.jsm#3261-3274 (as suggested by :rpl) but we didn't try.

Comment 3

[Mike Kaply [:mkaply]]

So the only downside to throwing the error there is that AMO shows the error, we don't get an error via the doorhanger, but I'm not convinced that's a big deal.

But we would have that same problem using mozAddonManager as well.

I'll see if there's some way to do the doorhanger in this case.

Comment 4

[Mike Kaply [:mkaply]]

Attachment: Bug 1735806 - Don't allow installs from AMO if not in policy install_sources r?willdurand!

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:mkaply, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9e4421c103b8
Don't allow installs from AMO if not in policy install_sources r=willdurand,extension-reviewers,rpl,flod

Comment 7

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/9e4421c103b8