Closed Bug 1757760 Opened 2 years ago Closed 2 years ago

Default engine is automatically switched if a WebExtension receives an update, even when opted out

Categories

(WebExtensions :: General, defect)

Firefox 97
defect

Tracking

(firefox-esr91 verified, firefox97 wontfix, firefox98 wontfix, firefox99 verified, firefox100 verified)

VERIFIED FIXED
100 Branch
Tracking Status
firefox-esr91 --- verified
firefox97 --- wontfix
firefox98 --- wontfix
firefox99 --- verified
firefox100 --- verified

People

(Reporter: deepak.gupta, Assigned: mixedpuppy)

References

Details

(Keywords: sec-other, Whiteboard: [addons-jira][adv-main99-])

Attachments

(3 files)

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.109 Safari/537.36

Steps to reproduce:

  1. Install a addon that takes over Default Search using Search Settings "chrome_settings_overrides"
  2. During install Opt-out from updating the Search engine
  3. Check for addon update
  4. If addon is updated with new version, Search engine is automatically updated without FF Opt-in message

Actual results:

If addon is updated with new version, Search engine is automatically updated without FF Opt-in message

Expected results:

If addon is updated with new version, Since user has already opted out from Search engine update, users should not be prompted for Search engine update and search engine should stay as is.

Including a bunch of folks so they're aware.

Andreas, is this your wheelhouse? If not, can you forward to whoever's it is?

Flags: needinfo?(awagner)

This would be an api bug (or maybe in the search service, but leaning to api right now). moving it for next triage.

Flags: needinfo?(awagner)
Product: Firefox → WebExtensions

Alex, can you try to reproduce? It would need to be a search engine that sets default in the manifest.

Flags: needinfo?(acornestean)
QA Contact: acornestean

Is this a security issue?

(In reply to Andreas Wagner [:TheOne] [use NI] from comment #4)

Is this a security issue?

I don't think so, but leaving that for triage. Getting QA confirmation first will also be helpful.

Keywords: sec-other

Hello,

I reproduced the issue on the latest Nightly (99.0a1/20220302212501), Beta (98.0/20220302164716) and Release (97.0.1/20220216172458) under Windows 10 x64 and Ubuntu 16.04 LTS.

I’ve opted to use an older version of the “Ecosia — The search engine that plants trees” – v4.0.3 as it matches the pre-requisites of setting a search engine via “chrome_settings_overrides” in the manifest.

Proceeding with the STR described in the issue, even though I’ve opted out from updating the Search Engine during add-on install, updating the add-on will also update the Search Engine automatically without the consent of the user, since the Opt-In/Out doorhanger is not displayed.

For further details, see the attached video.

Status: UNCONFIRMED → NEW
Ever confirmed: true
Flags: needinfo?(acornestean)
Attached video 2022-03-03_10h05_13.mp4

Hello, I am reaching out to see if this can be prioritizes as high. The bug is stopping us from pushing update to our Search extension as update will change Search engine for existing extension user who has opted out from this during installation flow.

Shane, given QA can repro can you or someone else on the add-ons team investigate and respond to comment #8?

Flags: needinfo?(mixedpuppy)

Seems people agree at least this isn't a security issue as such, so moving to moco-confidential and leaving it to the webextensions team to determine if this should just be public.

Group: firefox-core-security → mozilla-employee-confidential

Sorry for the delay looking back at this.

If I read between the lines, this is the str that should be verified.

  1. user installs an addon that has is_default
  2. during install they see the "set search as default" prompt, and say no.
    2a. the addon does not become the default search for firefox
  3. user later receives an update to the same addon
    3a. by design we never show the panel at this stage

expected result:

search engine is updated, but does not become firefox default search

actual result:

From the report and QA it sounds like it is becoming the default search, but I am not clear on that due to terminology (ie. it is being "updated")

Flags: needinfo?(mixedpuppy) → needinfo?(acornestean)
Group: mozilla-employee-confidential

Hello @Shane

I see where what I’ve reproduced earlier was a bit misleading so I’ll try and clear things out.

These are the STR that I used and the corresponding results:

  1. Install older version of “Ecosia — The search engine that plants trees” add-on, for example v4.0.0
  2. During add-on install, choose “No” on the “set search engine as default” prompt.
    Result: The search engine provided by the add-on is not set as the default search engine in Firefox as it can be seen in about:preferences#search.
  3. Update the “Ecosia — The search engine that plants trees” add-on.
    Result 1: The add-on is updated and no additional panels are shown.
    Result 2: The search engine provided by the add-on is set as the default search engine in Firefox as it can be seen after reloading about:preferences#search.

See the attached video for more details.

So the effect of this is that updating the search engine add-on will also set the search engine provided by the add-on as default in Firefox, without the user’s consent as the “set search engine as default” prompt/panel is not displayed at this stage (add-on update).

Hope this clears thing out.

Flags: needinfo?(acornestean) → needinfo?(mixedpuppy)
Attached video 2022-03-15_16h03_58.mp4

The Bugbug bot thinks this bug should belong to the 'Firefox::Search' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Component: Untriaged → Search
Product: WebExtensions → Firefox

Moving back to WebExtensions, as I think this is in the API code. Also updating title to better summarise the issue.

Component: Search → Untriaged
Product: Firefox → WebExtensions
Summary: Issue with Search Setting opt-in while updating addon → Default engine is automatically switch if a WebExtension receives an update
Summary: Default engine is automatically switch if a WebExtension receives an update → Default engine is automatically switched if a WebExtension receives an update
Summary: Default engine is automatically switched if a WebExtension receives an update → Default engine is automatically switched if a WebExtension receives an update, even when opted out
Assignee: nobody → mixedpuppy
Status: NEW → ASSIGNED
Flags: needinfo?(mixedpuppy)
Whiteboard: [addons-jira]
Pushed by scaraveo@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/f41423a594b9
retain correct search default setting after addon update r=rpl
Status: ASSIGNED → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → 100 Branch

Verified the fix on the latest Nightly (100.0a1/20220320213921) under Windows 10 x64 and Ubuntu 16.04 LTS.

Following the STR from Comment 12, updating the search engine extension will no longer set the default search engine in Firefox to the one provided by the extension, confirming the fix.

Status: RESOLVED → VERIFIED
Component: Untriaged → General

If I understand it right the fix will go in FF 100 based on release schedule (https://wiki.mozilla.org/Release_Management/Calendar) its 4/28 over a month away.

I am trying to see if this needs to be prioritized sooner than later, in my opinion extension developers (knowingly or unknowingly) can really abuse this issue to take over search setting in Firefox until the issue is fixed. Also I am planning to deploy some enhancement to my search extension and am hesitant to update existing users as update will override user's choice of using default Search engine without their consent.

There's one more beta tomorrow - is this safe enough for uplift?

Flags: needinfo?(mixedpuppy)
Flags: needinfo?(lgreco)

Comment on attachment 9268155 [details]
Bug 1757760 retain correct search default setting after addon update

Beta/Release Uplift Approval Request

  • User impact if declined: An addon update can change the default engine without user interaction.
  • Is this code covered by automated tests?: Yes
  • Has the fix been verified in Nightly?: Yes
  • Needs manual test from QE?: No
  • If yes, steps to reproduce:
  • List of other uplifts needed: None
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): Change is limited to addons with search engines and well covered in tests.
  • String changes made/needed: n/a
Flags: needinfo?(mixedpuppy)
Attachment #9268155 - Flags: approval-mozilla-beta?
Flags: needinfo?(lgreco)

Comment on attachment 9268155 [details]
Bug 1757760 retain correct search default setting after addon update

ESR Uplift Approval Request

  • If this is not a sec:{high,crit} bug, please state case for ESR consideration: default search can be modified by a simple addon update.
  • User impact if declined: same as beta request.
  • Fix Landed on Version: 100
  • Risk to taking this patch: Low
  • Why is the change risky/not risky? (and alternatives if risky): same as beta request.
Attachment #9268155 - Flags: approval-mozilla-esr91?

Comment on attachment 9268155 [details]
Bug 1757760 retain correct search default setting after addon update

Approved for 99.0b8. Thanks.

Attachment #9268155 - Flags: approval-mozilla-beta? → approval-mozilla-beta+

Comment on attachment 9268155 [details]
Bug 1757760 retain correct search default setting after addon update

Approved for 91.8esr.

Attachment #9268155 - Flags: approval-mozilla-esr91? → approval-mozilla-esr91+

Verified the fix on the latest Beta (99.0b8/20220324185704) under Windows 10 x64 and Ubuntu 16.04 LTS.

Following the STR from Comment 12, updating the search engine extension will no longer set the default search engine in Firefox to the one provided by the extension, confirming the fix.

Whiteboard: [addons-jira] → [addons-jira][adv-main99-]

Verified the fix on the latest ESR (91.8.0esr/20220330151638) under Windows 10 x64 and Ubuntu 16.04 LTS.

Following the STR from Comment 12, updating the search engine extension will no longer set the default search engine in Firefox to the one provided by the extension, confirming the fix.

You need to log in before you can comment on or make changes to this bug.