1750233 - JSON enterprise policies on Windows no longer work as REG_SZ

Status: VERIFIED FIXED

(Firefox :: Enterprise Policies, defect)

Description

[Brett]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:96.0) Gecko/20100101 Firefox/96.0

Steps to reproduce:

1.) Launch the Windows Registry Editor
2.) If it does not exist, create the "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Mozilla\Firefox" key
3.) On that key, create a new String Value with name "ExtensionSettings"
4.) Set the Data for this new value to "{"[e-mail]":{"installation_mode":"force_installed","install_url":"https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"}}"
5.) Open Firefox

Actual results:

uBlock Origin was not installed and there are the following errors on about:policies:

• Object expected but not received
• Invalid parameters specified for ExtensionSettings.

Expected results:

uBlock Origin should have been installed.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Win32' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Brett]

Some additional information:

• I believe this bug was introduced by https://bugzilla.mozilla.org/show_bug.cgi?id=1737605

• It affects ESR version 91.5 as well as 96.0

• The Firefox ExtensionSettings policy documentation does use REG_MULTI_SZ in the examples but REG_SZ has always worked up until now. Supporting REG_SZ keeps the Firefox ExtensionSettings policy consistent with Chrome (https://chromeenterprise.google/policies/?policy=ExtensionSettings) and Edge (https://docs.microsoft.com/en-us/deployedge/microsoft-edge-policies#extensionsettings) which both state that REG_SZ should be used

• It seems highly likely that this applies to all policies which use JSON but I have only personally tested with the ExtensionSettings policy

Comment 3

[Emil Ghitta, QA [:emilghitta]]

I can reproduce this issue.

Indeed this seems to be a regression caused by the changes performed in Bug 1737605.

Mozregression pushlog:

• https://hg.mozilla.org/integration/autoland/pushloghtml?fromchange=f369c2fc3ab7160413de89167a79af31fbd3b084&tochange=f7ec28ed7098dad0b0fe1a91abb6565b77316f63

This also seems to affect other policies which are applied using JSON (ExtensionSettings & Preferences).

Mike, can you please take a look? Setting this to S3 for now but we can bump it up after your evaluation

Thank you!

Comment 4

[Mike Kaply [:mkaply]]

The documentation for these values has always said they are REG_MULTI_SZ. (Personally I think Chrome made a mistake by not using MULTI_SZ since you have to put all of the JSON on one line).

That being said, I'll see if I can figure out something. The reason I did it this way is because it was the only way I could validate the JSON when the registry is read.

When we read the Windows registry, we don't know the type of the value, so we don't know to parse it as JSON.

Comment 5

[Mike Kaply [:mkaply]]

Attachment: Bug 1750233 - Allow JSON policy to be a REG_SZ. r?mstriemer

Comment 6

[Mike Kaply [:mkaply]]

So basically my previous patch tried way to hard to solve this problem. I should have just added the REG_MULTI_SZ parsing and then removed some unnecessary errors from the schema validator.

Comment 7

[Brett]

Thanks for looking into and fixing this so quickly, Mike. Do you know what version(s) the fix is likely to land in?

Comment 8

[Mike Kaply [:mkaply]]

I'll try to get it in the 97 and 91.6 ESR since it's a regression.

Comment 9

[Brett]

Great, thank you.

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b52cd455661f
Allow JSON policy to be a REG_SZ. r=mstriemer

Comment 11

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/b52cd455661f

Comment 12

[BugBot [:suhaib / :marco/ :calixte]]

The patch landed in nightly and beta is affected.
:mkaply, is this bug important enough to require an uplift?
If not please set status_beta to wontfix.

For more information, please visit auto_nag documentation.

Comment 13

[Mike Kaply [:mkaply]]

Comment on attachment 9259743 [details]
Bug 1750233 - Allow JSON policy to be a REG_SZ. r?mstriemer

Beta/Release Uplift Approval Request

• User impact if declined: Policy that use to work as a string doesn't.
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: In bug
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only, brings back mostly preexisting code
• String changes made/needed:

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: Policy only
• User impact if declined: Policy that use to work as a string doesn't.
• Fix Landed on Version: 98
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Policy only, brings back mostly preexisting code

Comment 14

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9259743 [details]
Bug 1750233 - Allow JSON policy to be a REG_SZ. r?mstriemer

Approved for 97.0b9 and 91.6esr.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/a3fa76bff28f

Comment 16

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a6a2817c648b

Comment 17

[Daniel Bodea [:danibodea]]

Attachment: policies for uBlock auto-installation.png

I have also reproduced this issue on an affected build (Release v96.0.2), but I can't verify the fix in Nightly v98.0a1 because uBlock extension still doesn't auto-install, however, some policies errors are no longer displayed.

• affected build:
  Object expected but not received
  Invalid parameters specified for PictureInPicture.
  Unknown policy: New Key #1

• fixed build:
  Invalid parameters specified for PictureInPicture.
  Unknown policy: New Key #1

Mike, have added the policy key correctly?
Are the steps in comment 0 valid?

Comment 18

[Mike Kaply [:mkaply]]

Attachment: Registry file for test

Extension Settings should be right clicking on Firefox and selecting new String.

I've attached a .reg file that shows it.

And yes, some validation errors don't show anymore.

This was a compromise for multiple typed objects.

Comment 19

[Daniel Bodea [:danibodea]]

I have verified the fix in Nightly v98.0a1 from 2022-01-27, Beta v97.0b9 (taken form https://treeherder.mozilla.org/jobs?repo=mozilla-beta&revision=039a407f576d42ed26b922fb33c1b97b340cc7fd&selectedTaskRun=fTQoDehpThecIqx3-A_PEg.0) and ESR v91.6.0esr (from https://treeherder.mozilla.org/jobs?repo=mozilla-esr91&revision=d9ece6f47d6cff7c882485911044faa5a5f5460c)